Symptom

Clients without a rate-limit get a rate-limit added when another client on the same WLAN and same AP get a rate limit override from RADIUS. Example: 1 Create a Flex LS or SDA WLAN without a QoS client policy Bring in a client that get back just an access-accept from ISE Check the AP cli and see that there is no rate limit applied to the client. ap# show rate-limit client Now bring in another client and have ISE send back the AVPs for bdrl. Check the AP cli and see that the rate limit was applied to both clients. 2 Create a Flex LS or SDA WLAN WITH a QoS client policy Bring in a client that get back just an access-accept from ISE Check the AP cli and see that the QoS client policy from the policy profile is applied to this client. Now bring in another client and have ISE send back the AVPs for bdrl. Check the AP cli and see that the rate limit from ISE was applied to both clients.

Conditions

9800 running 17.6.2 and above up to 17.9.4 Wave 2 and 11AX APs Flexconnect Local Switching WLAN or an SDA WLAN AAA override for bi-directional rate limiting (cisco-av-pair = ip:sub-qos-policy-in= cisco-av-pair = ip:sub-qos-policy-out=)

Workaround

Do not override the client qos policy

Further Problem Description