Symptom

If a static IP to SGT mapping is added to the C9800 for a wireless client, that SGT is not propagated over the uplink even when configured to support inline tagging. SGT 0 is always seen to be propagated.

Conditions

Inline tagging enabled on C9800 uplink and policy profile. Authenticate a wireless client but do not dynamically assign an SGT via RADIUS authorization. Add a static IP to SGT mapping using the IP assigned to the wireless client. Send traffic from wireless client and check the CMD field of the frames sent over the uplink. SGT 0 is always sent, not the static SGT assigned.

Workaround

Either assign an SGT dynamically via RADIUS authorization or propagate the static IP to SGT mapping using SXP.

Further Problem Description