topic You might start by doing a in Network Access Control

Guest Re-Authentication on ISE

Joseph Oloyede — Mon, 11 Mar 2019 04:30:06 GMT

Good Afternoon,

Am using ISE 1.2 to authenticate guest users on the WLC.

I created a sponsor account that creates guest credentials (username and password) and a time profile of 8hours, 24hours, 1week, 1month and 3months repectively and it worked fine.

Recently, it accepts the guest credentials and gives access to the network for about 2 to 3 minutes before it terminates the session and asks the user to re-authentication on the guest portal. This continues repeatedly irrespective of the time profile i choose. Moreover, every other users aside from the Guest users authenticate on the ISE without such challenge.

Thanks for ur suggestions in advance.

Re: Guest Re-Authentication on ISE

Naresh Ginjupalli — Thu, 06 Mar 2014 14:38:54 GMT

Hi Joseph,

As shown in below screen shot , For Authz profile that these guest are hitting there is a default session timeout value set for re-authentication and also there is a attribute to maintain connectivity .

Maintain Connectivity During Reauthentication has two option :

Default :- If you set this option , it will take the CoA action 'Terminate'

Radius-Request :- If you set this option , it will take the CoA action 'Re-auth'

Can you please check if these values are intact to your configuration.

Re: Guest Re-Authentication on ISE

Joseph Oloyede — Fri, 07 Mar 2014 09:06:33 GMT

Hello nginjupa,

Thanks for the assistance, however, am not using the reauthentication option in the Authz profile. Am using a DACL name of which i have create the access-list on the Downloadable ACLs. This is used to push down the access-list to the switch and the WLC.

It still gives access to the network after authentication by the guest user, but knocks the user off after about 3 - 5 minutes. That is, the user will have to re-authenticate again with the same credentials and the problem re-occur again over and over.

See below the screen shots for both the Authz profile and the Authz policy.

Re: Guest Re-Authentication on ISE

Parag Mahajan — Fri, 07 Mar 2014 16:56:50 GMT

Hi ,

Its worth checking SSID setting in - > advanced - >Enable Session Timeout . Hope the value configured around 1800 ..

You might start by doing a

Bastien Migette — Sun, 09 Mar 2014 21:22:24 GMT

You might start by doing a debug client <mac> and see on the WLC what causes client disconnection.

Also make sure you are running a recent version of the WLC as there could be some issues.

Check also what is the Policy state of the client after web auth. It should move from WEBAUTH_REQD to RUN (you can see this in the monitor > Client menu). WLC will expire all clients that are in WEBAUTH_REQD state after 10 mn.

Sample autorization policy

Venkatesh Attuluri — Tue, 11 Mar 2014 13:19:43 GMT

Sample autorization policy for guest user

Hi!I have the same problem

a.dvorak — Wed, 12 Mar 2014 22:15:42 GMT

Hi!

I have the same problem since yestarday because I have updated the wlc to 7.4.121 and the Ise to patch6-Meanwhile I am thinking that could be a bug or a change in the default properties-I don´t know.

I hope somebody can solve the problem-otherwise I should open a case.... 😞

regards alex

check the WLC for time out

kaaftab — Thu, 13 Mar 2014 18:45:53 GMT

check the WLC for time out value if no change has been made on ISE since last deployment.

I have the exact same problem

awatson20 — Fri, 21 Mar 2014 00:14:21 GMT

I have the exact same problem. TAC said it looked like a bug. Have you come up with a work a round? https://tools.cisco.com/bugsearch/bug/CSCul43158 Symptom:Wireless devices are randomly disconnected every 5-10 minutes with unknown policy timeout message in debug client Conditions:Clients using Central Web Authentication (CWA). Workaround:none More Info:

Hi Guys,I am also facing the

Pranav Gade — Tue, 12 Aug 2014 09:02:03 GMT

Hi Guys,

I am also facing the same issue as we have updated the image to 1.2.1 and usinf cwa ( mac filtering ) on wlc, session time 1800 on wlc.

But still after 5-6 min guest user asking for username and password to guest redirection url.

Can anybody gives me the solution for the same.

Thanks & Reagrds

Pranav

It is a software bug on the

awatson20 — Tue, 12 Aug 2014 09:44:50 GMT

It is a software bug on the wireless controller software 7.4MR2. You need to open a TAC case and request an engineering release from Cisco that contains the fix. The fix was put in 7.4.121.17

I had the same problem. I

andres.picos — Fri, 26 Sep 2014 23:16:19 GMT

I had the same problem. I have vWLC and 2500 series WLC. The bug CSCul43158 Was fixed.

I upgrade from 7.6.100 to 7.6.130.0 and the problem was fixed. Now the wireless is working fine.

We had the same challenges.

bhose — Sat, 27 Sep 2014 11:58:51 GMT

We had the same challenges. The issue is that the device is going to sleep and the WLC times out the connection.

The way we fixed it was to use RADIUS attribute in the AuthZ profile to set the session timeout and inactivity timeout value to 8hrs. Works great

same issue, I have tried to

egodalisse — Mon, 12 Sep 2016 12:22:30 GMT

same issue, I have tried to configure both the radius attributes Radius:Idle-Timeout and Radius:Session-Timeout. Bot hhave been set to 1900.

I keep being disconnected around 10 min after the iphone goes to sleep.

Could you show us your authorization profile ?

What version of software are

awatson20 — Mon, 12 Sep 2016 12:28:20 GMT

What version of software are you running on your wireless controllers?

8.0.133 on both the foreign

egodalisse — Mon, 12 Sep 2016 16:44:11 GMT

8.0.133 on both the foreign and anchor controllers

I have been told we can configure the user idle time out per SSID on 8.1