topic Enable Session Timeout in WLC in Wireless

Enable Session Timeout in WLC

mahesh18 — Sun, 04 Jul 2021 07:48:13 GMT

Hi everyone,

I can connect to WLC and i disconnect then.Wehn i am back in coverage area it automatically connects me again.

Need to understand is this die to the enable session timeout settings in advanced field of SSID?

IF enable timeout is checked then does it remember the user credentials for that amont of time that is config in enable session timeout?

Regards

Mahesh

Re: Enable Session Timeout in WLC

George Stefanick — Tue, 10 Sep 2013 17:55:33 GMT

No Sir.. That feature will kick a client off when the timer his hit. Thus causing the client to reauth. In your case when you leave coverage and return you are coming back onto the network and requires a reauth. If you are trying to keep a session live you could move the idle session timer higher. Although this is a work around and I wouldn't suggest it.

Normal practice is you should reauth when you leave and come back into the network .. As for asking for you ID. Most supplicant cache this or are configured to present them for you to the wireless.

Can you share more about what you are trying to archive ?

Sent from Cisco Technical Support iPad App

Re: Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 20:07:09 GMT

Hi George,

I want to know when i take my cell phone near the WAP today it connects me automatically.

I can see the IP address on my cell phone.

so need to understand if radius authentication is config on WLC then when i come closer to coverage area before giving IP to my cell phone it should ask for PW right?

How my PC is getting IP automatically when i come close to coverage area?

Regards

Mahesh

Re: Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 20:10:31 GMT

Mahesh18,

I guess that your WLC is setup with locally stored password (pre-shared password). When you first time connected your phone it probably cashed that password. Try and make your phone "forget" your network - it should not re-join. Same applies to your PC.

Re: Enable Session Timeout in WLC

George Stefanick — Tue, 10 Sep 2013 20:12:27 GMT

Ok, some assumptions here on my part based on your comment.

You are using radius. When your wifi station comes into coverage and its configured for the network and your supplicant is configured to join automatically. Your station will connect to the wifi and radius auth will happen. After you pass then you get an IP address.

EAP is layer 2. Once you are authenticated then you get layer 3 (ip address) and network connectivity.

Does this anwser your question ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 20:14:30 GMT

Hi Vlad,

But the password was RSA token so does it remembers RSA token also?

Regards

Mahesh

Re: Enable Session Timeout in WLC

Abhishek Abhishek — Tue, 10 Sep 2013 20:14:50 GMT

You need to do re-auth each and every timeout the session is timed out. To increase the session timer you can increase the idle time-out.

Enable Session Timeout in WLC

George Stefanick — Tue, 10 Sep 2013 20:16:08 GMT

Under your controller tab what is your user idle timer at ?

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 20:18:04 GMT

Hi George,

It is 300 secs.

Regards

Mahesh

Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 20:19:07 GMT

No, it should not remember anything related to EAP-types. There may be user never dropped out. Does the WLC show the user been still authenticated or does the user disapear? (Client section of the GUI).

Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 20:26:15 GMT

Wrong statement above. Profiles should not retain anything related to your RSA tokiens. But the generated pairwise master keys may be retained for some time before they expire. I am not sure but 'debug aaa events enable' may reveal what is happenning.

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 20:34:27 GMT

Hi Vlad,

If i enable debugging how can i see the debug output?

in switches we use terminal monitor.

Also how can i stop debugging ?

Regards

Mahesh

Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 21:11:04 GMT

If you are logged in to the WLC over SSH you don't need the "terminal monitor" - just "debug ... ". To disable you can use wither "debug aaa events disable" or "debug disable-all". Also debug will stop if you exit ssh session.

As usually whith debug be careful not to over-stress your terminal sessions.

Re: Enable Session Timeout in WLC

George Stefanick — Tue, 10 Sep 2013 21:22:21 GMT

I world think idle timeout would kick in delet the client record along with the pmk ..

Sent from Cisco Technical Support iPhone App

Re: Enable Session Timeout in WLC

George Stefanick — Tue, 10 Sep 2013 21:24:33 GMT

Along with Vlads comment I would do a client debug leave the network and come back back on .. Post the log

Sent from Cisco Technical Support iPhone App

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 21:38:29 GMT

Hi Vlad,

I enable the debug aaa events enable bit i see no output on CLI?

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 21:39:51 GMT

Debug client alone does not work.

should i use some options?

Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 21:43:02 GMT

Are there authentication events happening? There will be nothing until your authenticate/reauthenticate.

Also the command that George mentioned above - are you just running debug client? There shall be trailed MAC address after the command of the client you wish to debug.

Enable Session Timeout in WLC

mahesh18 — Tue, 10 Sep 2013 21:44:12 GMT

Hi George,

More update my PC gets IP automatically but to access the internet it ask for Authentication which is RSA?

Regards

Mahesh

Enable Session Timeout in WLC

vlad.mihailov — Tue, 10 Sep 2013 21:45:21 GMT

Yes I think so too. Session should time out and get cleared from the WLC along with all its attribute. That is my understanding..