topic Re: ISE Guest accounts stop working after 21 days in Network Access Control

ISE Guest accounts stop working after 21 days

Cliffer — Fri, 08 Mar 2024 13:09:16 GMT

Hi team!

We have been struggling with an issue after migrating our ISE deployment from 2.6 to 3.1 last year.

We found out that accounts used for Wifi guest solution stop working properly after 21 days of being created using the Sponsor portal. The behaviour is that the user cannot navigate anymore and this is how it looks from Guest Accounting reports page:

From a policy perspective, the attempt seems to get stucked at the CWA redirection and we couldn´t find anything relevant on the Live logs, except that compared to a working device, Step 15048 doesn´t appear for a non-working device.

This happens to any kind of device and once the account stops working, it doesn´t work anymore until we create it again. On the Sponsor portal, the accounts are not locked or expired.

We use AD for authentication and another strange behaviour is that some accounts are not able to creat guest accounts which work, even if they are on the same AD group.

Any help or suggestion will be much appreciated. I could provide more details but didn´t want to make it very extensive.

Thanks.

Re: ISE Guest accounts stop working after 21 days

ahollifield — Mon, 11 Mar 2024 12:19:33 GMT

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

Endpoint purge rules? Are you using Guest Flow in the policy?

Re: ISE Guest accounts stop working after 21 days

Dustin Anderson — Tue, 12 Mar 2024 14:32:45 GMT

So, 2 things I can think of that we saw on ours.

1) You may have your portal creating a 21 day account if that is all they are getting, check the portal settings.

There is also a second place to check and that is under guest type.

The last thing we ran into is the endpoint purge. This was deleting registered guest endpoints. By default it is 30 days from registration, I had to change ours to 30 days inactive. You can find this under Administration>>Identity Management>>Settings and will see endpoint purge on the left.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Tue, 12 Mar 2024 19:05:24 GMT

Thanks for taking the time to answer. The purge rules we have are the following, where the first two are not actually in use because those IdentityGroups are not referenced anywhere. The third one is related, however the days doesn´t match. We could try to disable it though.

The other purge policy is the following, although we are able to see how a non-working account is not expired nor purged with this policy.

Regarding the Guest Flow, yes, we use it and the weird thing is that it´s the same configuration as it was on previous deployment, version 2.6. Now we have version 3.1, patch 7.

The CWA redirection policy result is the following:

One more thing we realized is that an account when stop working, it´s like it gets stucked on the CWA redirection policy according to the Live Logs.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Tue, 12 Mar 2024 20:05:32 GMT

Thanks Dustin for your reply.

For point 1, the solution we have implemented is a Sponsored Guest Portal, not the Self-Registered, so there is no option specify the valid days for an account.

For the second place, we have it just like your screenshot.

In regards of the last thing you mentioned, we already have it like that 😞

Re: ISE Guest accounts stop working after 21 days

Dustin Anderson — Tue, 12 Mar 2024 20:58:27 GMT

Yeah, that is odd that you have it set at 90 days but getting removed. Have you verified a new register shows the expiration date is in 90 days? This would rule out anything with the portal and point to something with purging rules.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Wed, 13 Mar 2024 13:31:32 GMT

Yes, we have verified that the expiration configured is the one being showed. But I don´t think is related to purging rules, because when an account is not working anymore, it could be still present in the Identity group, however, we have disabled the purging for the Identity group related, for testing.

Another behaviour we found is that some users belonging to the AD group that is authorized to create Sponsored accounts, are not able to create a working Sponsored account. I mean, the account just created by these users, never works.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Wed, 13 Mar 2024 14:07:43 GMT

This just happened so I´m adding some screenshots in order to give you more details.

An account created two months ago, that is still active and the MAC is present in the Guest Identity group is not working at the moment. In the Live Logs we can see how is redirected to the proper auth policy and is showed as connected for a couple of minutes, until the connection drops. In the Live Logs, is showing that goes back to the redirection policy and stays there.

Account details:

Re: ISE Guest accounts stop working after 21 days

Dustin Anderson — Wed, 13 Mar 2024 20:15:24 GMT

So, the only thing I see that is odd is when it works it's getting the guest username in the identity, but when it's not working it's presenting the mac of the phone. Does the system register the device at all as a guest endpoint? If so I wonder if you add to your or statement in the rule

Re: ISE Guest accounts stop working after 21 days

Cliffer — Wed, 27 Mar 2024 18:43:50 GMT

Yes, the system registers the device as a guest endpoint, or whatever Indentity group you define in the Guest types. The statement is added on the rule, we even tried without the Guest flow and the symptons are the same.

Re: ISE Guest accounts stop working after 21 days

Dustin Anderson — Wed, 27 Mar 2024 19:48:16 GMT

With it not passing a user, you may not be hitting the guest type. You may want to try with the SSID contains Guest and the GuestEndpoints group.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Fri, 05 Apr 2024 19:01:05 GMT

Hi Dustin,

When we tried removing the guest type from the auth policy, that didn´t work either for new connections. The attempts got stuck in the CWA redirection auth policy with the MAC as the username, as if the web redirection wasn´t working. And the sponsor portal doesn´t appear on the device in order to authenticate.

For a working account, this solution is still working, with the CWA redirection (until the three weeks pass)

Re: ISE Guest accounts stop working after 21 days

Dustin Anderson — Mon, 08 Apr 2024 13:16:46 GMT

Not sure why your redirect isn't working. Here is what we use for guest without issue. when they are on the redirect, if they put in an IP address do they redirect? Something not on your network.

Re: ISE Guest accounts stop working after 21 days

Cliffer — Fri, 26 Apr 2024 13:00:32 GMT

After some weeks of troubleshooting, apparently we finally found the issue. We disabled the "Enable Session Timeout" on the WLC for this guest SSID and the non-working accounts are starting to work again. Also new accounts after the 21 days.

I don´t understand the reason. Meanwhile, we are monitoring if everything is working as expected. Thanks for your support.

Re: ISE Guest accounts stop working after 21 days

lhernan455 — Tue, 27 Aug 2024 15:39:16 GMT

I am also having the same issue. Has your fixed of disabling the "Enable Session Timeout" caused an issues or is everything working as expected?

Re: ISE Guest accounts stop working after 21 days

Cliffer — Sun, 01 Sep 2024 16:39:48 GMT

Yes, we found out that after migrating the ISE, it was sending a timeout session very very big (a couple of millions), when that option wasn´t enabled on the ISE. Forcing the timeout session on ISE or disabling that option on the WLC, solved the issue.