topic Re: NAC agent on Wireless runs everytime we switch controllers in Network Access Control

NAC agent on Wireless runs everytime we switch controllers

jthullen — Mon, 11 Mar 2019 02:25:20 GMT

Hello all, we are seeing an issue in our enviroment and wanted inquire about it. We have a Cisco wireless infrastructure in place here - 2 5508 controllers and approx 200 3502 AP's. We have the AP's split evenly between the 2 controllers. We backend this system with an in-band NAC Applaince Clean Access Server for poster assesment. What we are noticing is that when a user "roams" from one AP to another, and if the AP's are connected to 2 seperate controllers, the NAC agent will run again. The Logs in the CAM support this, as we see the user being logged out and then logged back in. We have the 2 controllers configured in a mobility group that should allow roaming. So would this be expected behavior? Does the controller still send the RADIUS Accounting Stop packets to the CAS when it hands off a wireless session to another controller even if they are in a mobility group? Any help or thoughts would be appreciated.

Thanks,

Jeff

Re: NAC agent on Wireless runs everytime we switch controllers

Tarik Admani — Tue, 14 Aug 2012 15:44:11 GMT

Jeff,

Since you are using dot1x I found the following note in the mobility configuration guide:

http://www.cisco.com/en/US/docs/wireless/controller/7.2/configuration/guide/cg_mobility.html

All clients configured with 802.1X/Wi-Fi Protected Access (WPA) security complete a full authentication in order to comply with the IEEE standard.

From your radius server do you see a second authentication attempt come in from the second controller? If so then most likely this is due to the radius accounting stop and start messages during the roaming.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: NAC agent on Wireless runs everytime we switch controllers

jthullen — Tue, 14 Aug 2012 17:32:46 GMT

Tarik, that is exacly what we have confirmed via logs is happening. Thank you for your help in getting this resolved and answered!

Jeff