topic Re: Cisco 9800 Guest users getting disconnected post portal authentica in Wireless

Cisco 9800 Guest users getting disconnected post portal authentication

Chandhuru sekaran marimuthu — Wed, 08 Feb 2023 17:48:32 GMT

Hello All,

We have Cisco 9800 Guest users getting disconnected post portal authentication. Not all users few of users.

Setup:

Foreign 9800-L --> Anchor WLC 9800-L

Guest SSID --> Open Layer 2 Security, Layer 3 Web-Auth External URL redirection(Aruba Clearpass)

Mobility Tunnel between Foreign and Anchor.

Issue:

Users able to connect to Guest SSID and they redirect to portal and they entering username and password and get connected. That time user status as Run in both Anchor and Foreign WLC. In couple of minutes they disconnecetd and ask for authenticate portal again. That time in Foreign is Run state. In Anchor side it says Web-Auth Penidng state.

Both Foreign and Anchor in 17.6.4.

If anyone came across this kind of issue. That would be great. We need to fix ASAP. Any clue on this.

Regards,

Chandhuru

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Arshad Safrulla — Wed, 08 Feb 2023 18:46:40 GMT

Hi In your scenario, Radius authentication is handled by the anchor WLC. So you can run a RA trace to check exaxtly why the user was disconnected. You can have that analyzed using the WLC debug analyzer.

https://community.cisco.com/t5/wireless/wlc-debug-analyzer/td-p/2876223

That being said, I would like to see the timeouts that you have configured under Policy prrofile, also post the parameter map that is configured in the WLC.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Wed, 08 Feb 2023 18:53:09 GMT

Thanks Arshad,

Under Policy, Session Timeout - 28800 seconds, Idle Timeout is 3000 Seconds.

parameter-map type webauth global
type webauth
virtual-ip ipv4 192.0.2.1
!
!
parameter-map type webauth guest_web_auth
type consent
redirect for-login http:// <Aruba Clearpass IP>/guest/Cisco-Sponsor-Guest-Reg_2_4.php?_browser=1
redirect append ap-mac tag ap_mac
redirect append wlan-ssid tag ssid
redirect append client-mac tag client_mac
redirect portal ipv4 <Aruba Clearpass IP>
logout-window-disabled
success-window-disable
cisco-logo-disable

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 09 Feb 2023 16:25:56 GMT

Hello Arshad,

when we do RA trace on foreign side we could see “Mobility peer reset” logs. Could you please help us what could be the reason for this debug log???

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Mark Elsen — Thu, 09 Feb 2023 17:10:51 GMT

- Use this command show platform hardware chassis active qfp feature wireless punt statistics . check for error info's related to mobility issues , (if any)

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 09 Feb 2023 20:07:58 GMT

Hello Marce,

Please find the logs below,

CPP Wireless Punt stats:

App Tag Packet Count
------- ------------
CAPWAP_PKT_TYPE_DOT11_PROBE_REQ 901602
CAPWAP_PKT_TYPE_DOT11_MGMT 78793
CAPWAP_PKT_TYPE_DOT11_IAPP 10497761
CAPWAP_PKT_TYPE_DOT11_RFID 0
CAPWAP_PKT_TYPE_DOT11_RRM 0
CAPWAP_PKT_TYPE_DOT11_DOT1X 37146
CAPWAP_PKT_TYPE_CAPWAP_KEEPALIVE 620327
CAPWAP_PKT_TYPE_MOBILITY_KEEPALIVE 255561
CAPWAP_PKT_TYPE_CAPWAP_CNTRL 3052198
CAPWAP_PKT_TYPE_CAPWAP_DATA 0
CAPWAP_PKT_TYPE_CAPWAP_DATA_PAT 30
CAPWAP_PKT_TYPE_MOBILITY_CNTRL 149926
WLS_SMD_WEBAUTH 0
SISF_PKT_TYPE_ARP 129504
SISF_PKT_TYPE_DHCP 28724
SISF_PKT_TYPE_DHCP6 7266
SISF_PKT_TYPE_IPV6_ND 96520
SISF_PKT_TYPE_DATA_GLEAN 200
SISF_PKT_TYPE_DATA_GLEAN_V6 205
SISF_PKT_TYPE_DHCP_RELAY 1632
WLCLIENT_PKT_TYPE_MDNS 0
CAPWAP_PKT_TYPE_CAPWAP_RESERVED 0

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Mark Elsen — Fri, 10 Feb 2023 08:15:02 GMT

- Check the output(s) of these commands too :
show wireless mobility summary
show wireless stats mobility
show wireless stats mobility messages

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Fri, 10 Feb 2023 13:46:51 GMT

thanks Marce!!!

Could you help me to navigate the issue. I am new to 9800.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 23 Feb 2023 02:16:06 GMT

Hello All,

we have tried creating new SSID with anchor foreign relation with same VLAN and without radius authentication. Just WAP2-PSK. That client also facing same disconnection after connecting in few minute or so.

Debug analysis didn’t helped much.

now we isolated it’s not issue with radius auth configurations issue. Also we have increased session timeout to 86400 from 28800 didn’t help. Disabled FT didn’t help.

we are running out of ideas. Any help it would be appreciated.

TAC saying from the logs, client initiating dhcp release request. But verified working and not working lap both same model and same driver and version. But no luck.

please help us.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Mark Elsen — Thu, 23 Feb 2023 07:50:25 GMT

- Have a checkup of the configuration of both controllers with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer. Checkout all advisories!

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 23 Feb 2023 10:16:46 GMT

Hello Marce,

Thanks for your reply!!!

I could see no errors and only warnings there. I dont think those are harm to disconnect clients.

Quick Question: DHCP source interface not calling in Foreign controller Wireless management VLA, does it will impact client to get disconnect after authenticated(due to Asymmetric DHCP packets) in few minute(like 2 minutes)?

We saw clients getting webauth and connected able to browse for atleast 2 minutes and reauth happening. What would be the reason? Note: not all clients only few users

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Arshad Safrulla — Thu, 23 Feb 2023 12:55:45 GMT

Hi Chaduru,

Then I will check whether the MAC randomization of the clients is having any impact here, do your testing with MAC randomization off from the client side.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 23 Feb 2023 14:04:14 GMT

Hello Arshad,

Please find the answers below,

I am not sure what is the problem is, but I will start with checking whether you've enabled COA under the radius server settings and aaa override and NAC under the policy profile? These are mandatory for COA to work. Yes, COA enabled in Radius server configuration. AAA OVerride and NAC enabled and pointed at WLAN Policy profile.

Then I will check whether the MAC randomization of the clients is having any impact here, do your testing with MAC randomization off from the client side. We didnt check that.

How your WLC is connected to upstream switch? how the upstream switchports are configured? Is the APs in Flex (if flex local or central switching) or Local mode? Do you have any SVI's configured in the WLC (SVI's are needed only when you have mdns gateway or dhcp relay features in WLC) Do you have any kind of dhcp/arp snooping enabled in the switches?Upstream switch port configured as trunk and it is Central Switching not flex. APs in local mode. Foreign and Anchor mobility setup for Guest SSID. DHCP server(wintel server-common for all users 5508 WLC users as well) in anchor side . Snooping not enabled at switch side. SSID is Web-auth external URL redirection(Aruba Clearpass- same URL for 5508 users).

note: 5508 users able to connect and working fine.

Issue: Few of users able to connect to Guest SSID and working fine. Few users getting connected completing web-auth and getting internet for few minutes and re-authenticating and coming to web-auth page again.

we have tried creating new SSID with WPA2-PSK by skipping radius auth but anchor and foreign setup. Still same issue. Users getting reconnect every few minutes(approx 2 minutes)

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Fri, 01 Sep 2023 05:51:07 GMT

Hello All,

still there is no fix for this issue. Any help would be appreciated!!!

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Fri, 01 Sep 2023 05:55:46 GMT

Hello all,

this is debug logs collected from not working device.

2023/08/31 17:40:04.869692 {wncd_x_R0-0}{1}: [client-orch-sm] [17283]: (ERR): MAC: 4c44.5b59.5083 Client move to idle state, failed to get BSSID MAC

2023/08/31 17:40:04.869700 {wncd_x_R0-0}{1}: [client-iplearn] [17283]: (info): MAC: 4c44.5b59.5083 IP-learn state transition: S_IPLEARN_COMPLETE -> S_IPLEARN_IN_PROGRESS

2023/08/31 17:40:04.869739 {mobilityd_R0-0}{1}: [mm-client] [17837]: (debug): MAC: 4c44.5b59.5083 Received ipv4_address_update, sub type: 0 of XID (0) from (WNCD[0])

2023/08/31 17:40:04.869741 {wncd_x_R0-0}{1}: [apmgr-bssid] [17283]: (ERR): Failed to get the wlan_internal_policy record

2023/08/31 17:40:04.869743 {wncd_x_R0-0}{1}: [dpath_svc] [17283]: (ERR): MAC: 4c44.5b59.5083 Failed to get zone id of the client- error: 22, Invalid argument

2023/08/31 17:40:04.869744 {wncd_x_R0-0}{1}: [dpath_svc] [17283]: (ERR): Invalid BSSID handle, cannot check central NAT

2023/08/31 17:40:04.869830 {mobilityd_R0-0}{1}: [mm-client] [17837]: (info): MAC: 4c44.5b59.5083 Forwarding ipv4_address_update, sub type: 0 of XID (5595272) from (WNCD[0]) to (ipv4: 10.xx.xx.10 )

2023/08/31 17:40:04.869848 {wncd_x_R0-0}{1}: [client-orch-sm] [17283]: (info): MAC: 4c44.5b59.5083 Deleting the client, reason: 98, CO_CLIENT_DELETE_REASON_IP_DOWN_NO_IP, Client state S_CO_RUN

2023/08/31 17:40:04.869858 {mobilityd_R0-0}{1}: [mm-pmtu] [17837]: (debug): Peer IP: 10.xx.xx.10 PMTU size is 1385 and calculated additional header length is 76

2023/08/31 17:40:04.869877 {mobilityd_R0-0}{1}: [mm-client] [17837]: (debug): MAC: 4c44.5b59.5083 Sending ipv4_address_update of XID (5595272) to (ipv4: 10.xx.xx10 - Foreign WlC IP)

2023/08/31 17:40:04.869915 {wncd_x_R0-0}{1}: [client-orch-sm] [17283]: (note): MAC: 4c44.5b59.5083 Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_IP_DOWN_NO_IP, details: , fsm-state transition 00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|aa|ab|ac|18|28|33|42|44|46|48|4d|5c|5d|64|7f|90|a6|

2023/08/31 17:40:04.870012 {wncd_x_R0-0}{1}: [apmgr-bssid] [17283]: (ERR): Failed to get bssid mac address from bssid handle.

2023/08/31 17:40:04.870012 {wncd_x_R0-0}{1}: [client-orch-sm] [17283]: (ERR): MAC: 4c44.5b59.5083 Failed to get ap mac from bssid handle required for sending the trap

2023/08/31 17:40:04.870018 {wncd_x_R0-0}{1}: [client-orch-state] [17283]: (note): MAC: 4c44.5b59.5083 Client state transition: S_CO_RUN -> S_CO_DELETE_IN_PROGRESS

2023/08/31 17:40:04.870459 {wncd_x_R0-0}{1}: [ewlc-qos-voice] [17283]: (info): MAC: 4c44.5b59.5083 Successfully freed the bw for sip client

2023/08/31 17:40:04.870523 {wncd_x_R0-0}{1}: [multicast-main] [17283]: (info): MAC: 4c44.5b59.5083 No Flex/Fabric main record exists for client

2023/08/31 17:40:04.870527 {wncd_x_R0-0}{1}: [rog-proxy-capwap] [17283]: (debug): Managed client state notification: client left run state: 4c44.5b59.5083

2023/08/31 17:40:04.870691 {wncd_x_R0-0}{1}: [client-iplearn] [17283]: (info): MAC: 4c44.5b59.5083 IP-learn state transition: S_IPLEARN_IN_PROGRESS -> S_IPLEARN_DELETE_IN_PROGRESS

2023/08/31 17:40:04.870789 {wncd_x_R0-0}{1}: [dpath_svc] [17283]: (note): MAC: 4c44.5b59.5083 Client datapath entry deleted for ifid 0xa0000076

2023/08/31 17:40:04.870797 {wncd_x_R0-0}{1}: [mm-transition] [17283]: (info): MAC: 4c44.5b59.5083 MMIF FSM transition: S_MA_ANCHOR -> S_MA_DELETE_PROCESSED_TR on E_MA_CO_DELETE_RCVD

2023/08/31 17:40:04.870841 {wncd_x_R0-0}{1}: [mm-client] [17283]: (info): MAC: 4c44.5b59.5083 Invalid transmitter ip in build client context

2023/08/31 17:40:04.870883 {wncd_x_R0-0}{1}: [mm-client] [17283]: (debug): MAC: 4c44.5b59.5083 Sending handoff_end of XID (0) to (MobilityD[0])

2023/08/31 17:40:04.870942 {mobilityd_R0-0}{1}: [mm-client] [17837]: (debug): MAC: 4c44.5b59.5083 Received handoff_end, sub type: 0 of XID (0) from (WNCD[0])

2023/08/31 17:40:04.871000 {wncd_x_R0-0}{1}: [auth-mgr] [17283]: (info): [4c44.5b59.5083:mobility_a0000002] Raised event DELETE (19)

2023/08/31 17:40:04.871004 {wncd_x_R0-0}{1}: [auth-mgr] [17283]: (info): [4c44.5b59.5083:mobility_a0000002] Disconnect request from SANET-SHIM (15) for 4c44.5b59.5083 / 0xb900087d - term: none, abort: Unknown, disc: (default)

2023/08/31 17:40:04.871005 {wncd_x_R0-0}{1}: [sanet-shim-translate] [17283]: (note): MAC: 4c44.5b59.5083 Session manager disconnect event called, session label: 0xb900087d

2023/08/31 17:40:04.871007 {mobilityd_R0-0}{1}: [mm-transition] [17837]: (info): MAC: 4c44.5b59.5083 MMFSM transition: S_MC_RUN -> S_MC_HANDOFF_END_RCVD_TR on E_MC_HANDOFF_END_RCVD from WNCD[0]

2023/08/31 17:40:04.871025 {wncd_x_R0-0}{1}: [aaa-attr-inf] [17283]: (info): [ Applied attribute : username 0 "4C44.5B59.5083" ]

2023/08/31 17:40:04.871033 {wncd_x_R0-0}{1}: [aaa-attr-inf] [17283]: (info): [ Applied attribute :bsn-vlan-interface-name 0 "Guest_DMZ" ]

2023/08/31 17:40:04.871035 {wncd_x_R0-0}{1}: [aaa-attr-inf] [17283]: (info): [ Applied attribute : timeout 0 86400 (0x15180) ]

2023/08/31 17:40:04.871041 {wncd_x_R0-0}{1}: [aaa-attr-inf] [17283]: (info): [ Applied attribute : url-redirect-acl 0 "IP-Adm-V4-LOGOUT-ACL" ]

2023/08/31 17:40:04.871047 {wncd_x_R0-0}{1}: [client-auth] [17283]: (info): MAC: 4c44.5b59.5083 Client auth-interface state transition: S_AUTHIF_WEBAUTH_DONE -> S_SANET_DELETE_IN_PROGRESS

2023/08/31 17:40:04.871060 {wncd_x_R0-0}{1}: [apmgr-db] [17283]: (ERR): 0000.0000.0000 Failed to get radio oper stat record. Invalid stats record for slot=0 error:0

2023/08/31 17:40:04.871063 {wncd_x_R0-0}{1}: [apmgr-db] [17283]: (ERR): 0000.0000.0000 Failed to update per radio per slot clients count in stats record, did not get record, error No such file or directory

2023/08/31 17:40:04.871088 {wncd_x_R0-0}{1}: [dot11] [17283]: (info): MAC: 4c44.5b59.5083 DOT11 state transition: S_DOT11_ASSOCIATED -> S_DOT11_DELETED

Re: Cisco 9800 Guest users getting disconnected post portal authentica

JPavonM — Fri, 01 Sep 2023 06:11:44 GMT

You maybe hitting this bug CSCwb57391 that impacts IOS-XE 16.12 so recommendation is to move to any of the TAC recommended versions on 17.3, 17.6 or 17.9 trains.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Nieo — Thu, 26 Oct 2023 13:05:46 GMT

Hi Chandhuru,

We are facing exact same issue but here the WLC model is 5520 version 8.10.183.0. This is weird as not all users facing this problem. Are you able to get something on your problem ? Did you find the solution?

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 26 Oct 2023 15:43:54 GMT

Hello Nieo,

still no clue. Even TAC team don’t have any clue on this. Gave workaround as local SSID for Guest users. If you find anything please help me too.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

Chandhuru sekaran marimuthu — Thu, 26 Oct 2023 15:45:59 GMT

Sorry for late reply. We already in 17.6.4 version. Still have same issue. Users get connected and dropped out in 1 minute to 2 minute max. Above debug log only we getting.

Re: Cisco 9800 Guest users getting disconnected post portal authentica

gnijs — Thu, 27 Jun 2024 10:38:32 GMT

Hello, I have the same problem and am seeing the same log messages. did this ever get resolved ?