topic Re: Reauthenticate users every 60s for Guest users in Network Access Control

Reauthenticate users every 60s for Guest users

M1N10N — Fri, 06 Sep 2024 03:58:24 GMT

• Guest users were able to connect to the SSID and gaining network access by providing code using CWA, but after 60s network is getting disconnected and redirected CWA for reauthenticate.
• When users are created using sponsor portal via ISE 3.1 patch 6. If user with 24 day or less duration works without any issue, but when guest user duration configured with 25 days or more issue appears. We are using cisco wireless controller 5520 version 8.10.196.0.

Does anyone face this kind of issue?

Re: Reauthenticate users every 60s for Guest users

balaji.bandi — Fri, 06 Sep 2024 05:53:42 GMT

Looks for me some kind of bug as per information, have you tried collecting the debug logs from WLC and looked at ISE what is the reason its going to ask re-authentication.

is this for all devices of guest or any specific devices ?

Re: Reauthenticate users every 60s for Guest users

MHM Cisco World — Fri, 06 Sep 2024 06:23:54 GMT

It is two issue or one

Can you more elaborate

Thanks

MHM

Re: Reauthenticate users every 60s for Guest users

M1N10N — Fri, 06 Sep 2024 08:40:57 GMT

It is one issue the behavior is If we create guest user via ISE sponsor portal with maximum duration of 24 days, it works no issue. But if we create guest user more than 25 days, users able to authenticate via CWA but within 1min reauthentication message appears.

WLC packet capture I saw this output:

*apfReceiveTask: Sep 04 14:04:43.431: 3c:06:30:1d:e1:02 apfMsExpireMobileStation (apf_ms.c:8148) Changing state for mobile 3c:06:30:1d:e1:02 on AP 5c:e1:76:1a:07:e0 from Associated to Disassociated

*apfReceiveTask: Sep 04 14:04:43.431: 3c:06:30:1d:e1:02 Scheduling deletion of Mobile Station: reasonCode 2 (callerId: 45) in 10 seconds
*osapiBsnTimer: Sep 04 14:04:53.655: 3c:06:30:1d:e1:02 apfMsExpireCallback (apf_ms.c:688) Expiring Mobile!

Looks like it is a bug: CSCwa20143 : Bug Search Tool (cisco.com). If it is this bug, question is why 24 days and 25th day is the breaking point?

Re: Reauthenticate users every 60s for Guest users

M1N10N — Tue, 10 Sep 2024 11:02:43 GMT

Workaround, In ISE Authorization access profile, enable reauthentication timer and set to lower than 65000. Issue fixed