topic Re: Cisco ISE Counter for Authenticated Guests does not count up in Network Access Control

Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Tue, 17 Jun 2025 12:12:33 GMT

Hello community
We have built a Cisco ISE guest portal (sponsored portal) with login. In addition a Cisco WLC, which redirects the guests to the Cisco ISE portal. The authentication of the guests works without any problems. Unfortunately, the Authenticated Guest Counter remains at 0 and simply does not count up.
Does anyone have any idea what might be missing or not configured?

Many thanks

Re: Cisco ISE Counter for Authenticated Guests does not count up

Arne Bier — Tue, 17 Jun 2025 22:29:22 GMT

Is your WLC sending RADIUS Accounting requests to your ISE PSNs? have you validated that with a tcpdump? ISE can increase the counter when a user logs into the portal because that's 100% confirmation of a web authentication. But there are two other considerations, which only RADIUS Accounting can solve:

1) Guests returning on MAC Auth (RememberMe use-case) - no portal involved - the WLC sends Accounting Start

2) Guests disconnect from the WLC - the WLC sends Accounting Stop

In addition, RADIUS Interim Updates are also a great idea to keep reminding ISE that the session is still alive - with IOS-XE, a value of 2880 minutes (48 hours) is a decent one. However, I don't think most wireless clients will be active that long on the same WAP. it's more likely that the user roams, or re-connects - and then RADIUS Start/Stop does the job.

What version of ISE and what WLC are you using?

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Wed, 18 Jun 2025 10:42:15 GMT

Can you check

Guest access -> guest manage

Do you see guest user

MHM

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Wed, 18 Jun 2025 14:07:40 GMT

In the ISE I can only find Manage Accounts under Guest Access. All issued user accounts are displayed here, but not whether they are currently active or inactive.

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Wed, 18 Jun 2025 14:13:15 GMT

RADIUS Accounting is configured on the WLC.

But in a capture I can only see the RADIUS packets for authentication. But no RADIUS accounting packets.

#sh run aaa group server radius ! aaa group server radius ISE server name ISE1 server name ISE2 ! #sh wireless profile policy detailed POLICY_PROFILE ! Policy Profile Name : POLICY_PROFILE Description : Default Policy Profile Status : ENABLED ... Accounting list Accounting List : ACCT_LIST ... Interim Accounting Updates : ENABLED ... aaa accounting identity ACCT_LIST start-stop group ISE

WLC version 17.15.02
ISE version 3.3

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Wed, 18 Jun 2025 14:49:24 GMT

Account is generally configured on the WLC 9800.
RADIUS challenge packets can be seen in the capture from the ISE. But unfortunately no RADIUS accounting packages.
Here is the WLC config for accounting.

#sh run aaa group server radius ! aaa group server radius ISE server name ISE1 server name ISE2 ! #sh wireless profile policy detailed POLICY_PROFILE Policy Profile Name : POLICY_PROFILE Description : Default Policy Profile Status : ENABLED ... Accounting list Accounting List : ACCT_LIST ... Interim Accounting Updates : ENABLED ... aaa accounting identity ACCT_LIST start-stop group ISE

WLC version 17.15.02
ISE version 3.3

Re: Cisco ISE Counter for Authenticated Guests does not count up

Arne Bier — Wed, 18 Jun 2025 20:30:32 GMT

If you don't see RADIUS Accounting requests arriving at the ISE node, then you have a problem. Potentially getting blocked by a firewall? You need to allow destination UDP/1813 on your ISE PSN nodes.

You can also check the status of RADIUS packets on the C9800

show aaa servers

RADIUS Accounting requests should be acknowledged by the (ISE) server - if you see many requests, but 0 ACK, then that confirms Accounting is not working. Get that sorted - without Accounting, most RADIUS solutions are running blind.

While you're at it, if this turns out to be a firewall issue, ensure that you also allow CoA from ISE -> WLC destination UDP/1700 - the CoA is what ISE sends to the WLC to make Guest logins work.

Is your Guest Wi-Fi solution a Foreign/Anchor arrangement? In that case, on the Anchor WLC talks RADIUS to ISE.

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Thu, 19 Jun 2025 08:37:43 GMT

Can I see screenshots of

Home> guest

Thanks

MHM

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Thu, 19 Jun 2025 09:52:59 GMT

The guest portal is structured in such a way that the guest traffic is tunneled to the WLC with CAPWAP and then decoupled in a separate VLAN. In this VLAN is the ISE with an interface for the guest portal. Our service provider is also placed in this VLAN with his IP address as the default gateway and thus provides the Internet.

There is no firewall between the WLC and the ISE, as they are in the same network area in terms of MGMT. The RADIUS packets are exchanged to the ISE MGMT interface.

In TCPDUMP there is absolutely no sign of port 1813 UDP. The accounting is done exclusively via this port, which in turn uses the ISE as a trigger for the acitive guest counter?
Only packets for 1812 UDP authentication can be seen. It can also be seen here that CoA communication is taking place for a successful authentication of a guest user in the ISE portal. A CoA request is send from the ISE to the WLC. And the WLC sends a CoA-ACK back to the ISE.

The RADIUS servers look good. Accounting packets are also incremented. However, this does not necessarily mean that these have also arrived at the ISE?

#sh aaa servers RADIUS: id 1, priority 1, host 192.x.x.x, auth-port 1812, acct-port 1813, hostname ISE1 State: current UP, duration 2070597s, previous duration 0s Dead: total time 0s, count 0 Platform State from SMD: current UP, duration 1870597s, previous duration 0s SMD Platform Dead: total time 0s, count 0 ... Account: request 0, timeouts 0, failover 0, retransmission 0 Request: start 0, interim 0, stop 0 Response: start 0, interim 0, stop 0 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 0 Throttled: transaction 0, timeout 0, failure 0 Malformed responses: 0 Bad authenticators: 0 ... RADIUS: id 2, priority 2, host 192.x.x.x, auth-port 1812, acct-port 1813, hostname ISE2 State: current UP, duration 2070597s, previous duration 0s Dead: total time 0s, count 0 Platform State from SMD: current UP, duration 1870597s, previous duration 0s SMD Platform Dead: total time 0s, count 0 ... Account: request 12259, timeouts 18, failover 0, retransmission 18 Request: start 3986, interim 4267, stop 3988 Response: start 3986, interim 4267, stop 3988 Response: unexpected 0, server error 0, incorrect 0, time 4ms Transaction: success 12241, failure 0 Throttled: transaction 0, timeout 0, failure 0 Malformed responses: 0 Bad authenticators: 0 ...

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Thu, 19 Jun 2025 09:54:05 GMT

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Thu, 19 Jun 2025 10:17:42 GMT

all these are empty or only status ?

MHM

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Thu, 19 Jun 2025 10:32:00 GMT

Only in Guest Status is nothing available. The other widgets are filled with data.

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Thu, 19 Jun 2025 10:43:09 GMT

If it only guest status then check

Operation > radius > live sessions

Or do report for NAS with issue

Operation > reports > radius accounting

It can NAS not send account correctly

MHM

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Thu, 19 Jun 2025 12:31:33 GMT

Here are some information from the reports and live log.

Operation -> RADIUS -> Live Logs (Auth Failed & Session for WLC): One entry last for 24 hours say "Dynamic Authorization failed"
Report -> Guest -> Guest Account: Last Entry three weeks ago
Report -> Guest -> My Devices Login and Audit: Register + CoA Reauth from today are displayed
Reports -> Endpoints and Users -> RADIUS Accounting: Last Entry three weeks ago
Reports -> Endpoints and Users -> Current Active Sessions: Current entries from today
Reports -> Diagnostic -> RADIUS Error: No errors for WLC

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Fri, 20 Jun 2025 10:48:56 GMT

Operation -> RADIUS -> Live Logs (Auth Failed & Session for WLC): One entry last for 24 hours say "Dynamic Authorization failed" <<- are you sure quest work fine ?

for live log you must see such as below

start-stop-interimUpdate

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Fri, 20 Jun 2025 13:19:27 GMT

Nothing can be seen today in the live log for the last 24 hours for the WLC and Failed Auth & Session.

In the Report -> Endpoint & Users -> RADIUS Accounting you can see that 3 weeks ago there was still data for Accounting Start, Stop & Interim Update. But that was 3 weeks ago. No current data.

Can an accounting be triggered on the WLC via CLI?

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Fri, 20 Jun 2025 16:09:00 GMT

get it, WLC is not send account anymore I think
check if FW block ports
what is WLC platform you have ?

MHM

Re: Cisco ISE Counter for Authenticated Guests does not count up

Arne Bier — Sat, 21 Jun 2025 02:12:23 GMT

You can’t trigger accounting. You can trigger a test aaa authentication but that does not involve accounting. You need an active session to cause accounting to work.

Have you tried running a monitor capture session on the outgoing interface on the WLC?

Please share output of
show run | section radius
show run | include aaa

Details are important. What IOS-XE version? Maybe there is a bug?

Re: Cisco ISE Counter for Authenticated Guests does not count up

Marco Serato — Mon, 18 Aug 2025 13:51:26 GMT

Hello community
I still owe you an answer. We have updated to the latest version and since then the problem is gone. Seems to have been a problem in the version.

Re: Cisco ISE Counter for Authenticated Guests does not count up

MHM Cisco World — Fri, 22 Aug 2025 10:51:17 GMT

Sorry I pass your authority and select your last reply as solution.

Now can you check if radius account work after upgrading?

Thanks a lot for update us

MHM