topic Dynamic Authorization failed - COA centralized web authentication in Network Access Control

Dynamic Authorization failed - COA centralized web authentication

Gustavo Andres Ponce Yumbato — Mon, 11 Mar 2019 04:38:44 GMT

I configured a centralized web authentication with users in the Active Directory. The problem is CoA, but it is enable in the ISE and WLC.

CoA Problem:

WLC :

(Cisco Controller) >show radius rfc3576 statistics
RFC-3576 Servers:

Server Index..................................... 1
Server Address................................... 192.168.73.210
Disconnect-Requests.............................. 0
COA-Requests..................................... 0
Retransmitted Requests........................... 0
Malformed Requests............................... 0
Bad Authenticator Requests....................... 0
Other Drops...................................... 0
Sent Disconnect-Ack.............................. 0
Sent Disconnect-Nak.............................. 0
Sent CoA-Ack..................................... 0
Sent CoA-Nak..................................... 0
Server Index..................................... 2

I have exactly the same

KevinMuller — Thu, 17 Apr 2014 13:46:59 GMT

I have exactly the same problem. In your logging do you have also this kind of message :

*radiusCoASupportTransportThread: Apr 17 14:23:38.060: #AAA-3-COA_WRONG_NAS_IP: radiusCoAsupport.c:1023 Received IP address[xx.xx.xx.xx] for CoA Packet.

I have tried lot of different configuration but nothing works, I have to do a "Session reauthentication" manually in the live sessions page.

check the following

Venkatesh Attuluri — Fri, 18 Apr 2014 11:52:58 GMT

check the following discussion

https://supportforums.cisco.com/discussion/11679106/ise-dynamic-authorization-failed

https://supportforums.cisco.com/discussion/11602806/dynamic-authorization-failed

Thanks for your help, but

KevinMuller — Fri, 18 Apr 2014 12:33:31 GMT

Thanks for your help, but already seen for my part.

If gustavoponce has the same problem as I have, manually reauthentication works fine, so I don't think it's a network issue, I'm thinking more of a parameters missing in WLC and/or ISE.

Thanks everyone! but I could

Gustavo Andres Ponce Yumbato — Mon, 21 Apr 2014 15:57:33 GMT

Thanks everyone! but I could not solved it.

The scenario is as follows:

I configured a SSID : CAMPUS in a university with centralized web authentication. When an Active directory user login (students) will be redirect to vlan 101 and if is a guest user to vlan 102. The authentication is good! (ISE Log, pimage above) but I think Guest flow is not working because the authentication web appear again after login.

*AD/guest sequence for Guest Portal Authentication.

In WLC Nac state: Radius Nac, Allow AAA override and rfc 3576 is enable in ISE (reauth) and WLC, the versions are : ISE 1.2 PATCH 7 and WLC 7.4.121.

I'm having this problem as

Cheezus01 — Wed, 13 May 2015 07:32:06 GMT

I'm having this problem as well, were you able to solve it eventually?

Re: I'm having this problem as

Network Engineering — Sat, 23 Nov 2019 04:19:23 GMT

Don't use the service interface. Use the management interface.