topic Re: Radius session not found ISE and Guest Portal / Sponsored Portal in Network Access Control

Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 11:54:11 GMT

When client joins network for a first time, we get "Radius session not found. Please contact helpdesk for assistance". After turning WiFi of the device Off and back on, everything works fine. We are running 17.11.1 on WLC9800 and 3.2 patch 4 on ISE

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

ahollifield — Mon, 22 Jan 2024 12:19:49 GMT

Sounds like CoA is not properly configured on ISE and/or the controller.

Also why 17.11.1? Why not 17.12.X?

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

MHM Cisco World — Mon, 22 Jan 2024 12:21:15 GMT

debug packet logging acl ip 1 permit <ISE IP>

Can you share the debug between WLC and ISE

MHM

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 12:54:49 GMT

Don't have that option...

MY681-WLC001#debug packet ? <cr> <cr>

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 12:57:50 GMT

At the times when I tried 17.12.x, all WAP's were constantly disconnecting and were causing issues on network. However I can give it another go indeed.
As for the CoA, I am not sure what is there to be misconfigured? Some stations do work from the first attempt, but some not. It used to be all the time that first time attempt ended in the error but then we realised that RADIUS server in WLC was not configured in correct RADIUS group, and after that, situation improved a lot, however it still happens every new client. When testing, I remove MAC address from WLC and ISE to reproduce but that does not always produce the error

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

ahollifield — Mon, 22 Jan 2024 13:10:38 GMT

https://community.cisco.com/t5/security-knowledge-base/ise-and-catalyst-9800-series-integration-guide/ta-p/3753060

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

MHM Cisco World — Mon, 22 Jan 2024 13:22:20 GMT

Debug not in enable mode in user mode

MHM

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 13:54:46 GMT

MY681-WLC001>debug ? % Unrecognized command

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

Aref Alsouqi — Mon, 22 Jan 2024 15:38:31 GMT

Not sure, but the issue could be caused by having the RADIUS session split across multiple PSNs. If you have multiple PSNs, did you configure one authorization rule for each one to redirect guest traffic?

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 15:58:59 GMT

There is only one PSN configured. I have seen the post with F5 load balancing but that does not solves my issue I am afraid. We run everything on a single VM.

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

ahollifield — Mon, 22 Jan 2024 16:07:28 GMT

Single standalone VM? I would highly suggest adding an additional 1-2 VMs. Note that a single VM is only supported for evaluation use-cases: https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Mon, 22 Jan 2024 16:15:55 GMT

Is a small environment and VM is running in on VMWare cluster (redundant servers). What benefits would be of multiple VM's? Offloading?

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

ahollifield — Mon, 22 Jan 2024 16:20:03 GMT

High Availability

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

MHM Cisco World — Mon, 22 Jan 2024 16:21:34 GMT

We need to make sure the issue is from wlc or ise.

Can you check IP of client and excluded list in wlc' it can client add to exclude list. When trun down and up the client get new IP and hence can auth via ISE.

MHM

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Tue, 23 Jan 2024 17:55:31 GMT

Clients do not end in Excluded list at all (unless they made mistake in PSK). They get address in same IP range both times, first when it fails and second when it works. And they can reach ISE web portal both time, however that authentication part is not working (always) first time. I am still struggling to reproduce the issue but it happens mostly on newly added devices.

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

Arne Bier — Wed, 24 Jan 2024 20:27:49 GMT

I had this phenomenon many years ago with ISE 2.2/2.3 but there were F5 load balancers involved. Sadly I can't recall what the resolution was. Perhaps you already have, but my checklist would check the following

Check that 9800 Integration Guide that Adam posted and compare your IOS-XE configuration and ISE configuration as close as possible. Adam makes a good point about the CoA - check that on the 9800 the IP address of ISE is listed as a client and if need be, re-enter the RADIUS pre-shared key exactly as it appears in ISE for that 9800 (rule that out just to preserve your own sanity!)

show run | sec radius show run | in aaa show run | in http show run | sec access-list

Enable a tcpdump on the ISE interface and then delete MAC from WLC/ISE and try to catch the issue - analyse in Wireshark for clues

Analyse your RADIUS Policy Set to mimic how the Wireless MAB traffic must flow - post it in the Community if you want and we can also have a look.

By the sounds of it, you have done everything right.

Last resort things:

Restart the 9800
Restart ISE (in my experience, restarting ISE doesn't fix authentication issues ... it's usually something else ...)

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

MHM Cisco World — Mon, 29 Jan 2024 22:16:02 GMT

Hi friend

Sorry for late reply

There are two authc and authz

1- open and mac filter (before portal)

2- open and mac filter (after portal)

These two stages happened because of CoA

So please

In wlc do (before and after)

Show client detail

In ISE

In live log

Share here

Thanks

MHM

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

vaniat — Wed, 31 Jan 2024 07:56:01 GMT

Attached is radioactive trace of client that first fails and then wifi is turned off and back on and then it all works fine. On WLC cli I am not able to find "show client detail" 😞

I will try today to make wireshark capture and analyse it.

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

MHM Cisco World — Wed, 31 Jan 2024 09:16:25 GMT

thanks a lot
waiting the wireshark files
MHM

Re: Radius session not found ISE and Guest Portal / Sponsored Portal

Aref Alsouqi — Wed, 31 Jan 2024 10:25:09 GMT

In 9800 WLCs you go to Monitoring > Wireless > Clients and then you click on the client which will open a new tab with all the details.

I think this issue could potentially be caused by having a split session between the PSNs. If you have multiple PSNs, did you create multiple authorization rules for guest traffic redirection?