topic Re: Clients losing connectivity to guest wireless network in Wireless

Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 09:13:02 GMT

Hello all,

I have an issue where wireless users that are connecting to the guest wireless network by entering their credentials through the guest portal are losing connectivity at random intervals(usually within 1 minute of connecting).

From the user side it looks fine the 1st time they enter their credentials in the portal but at a random time the machine loses connectivity and to restore it usually user needs to re-enter their credentials but the problem persists and they have to re-enter their credentails again. This behaviour continues in a loop and effectively the user cannot work on the network.

On the event log on the WLC I see the following events on the client event log(in attachment).

Info on the devices:
WLC 3504, version 8.10.190.0
APs - mostly 2702 APs with several 1832 and 1702 APs
For RADIUS we use Cisco ISE, version 3.2.0.542, patch 5

Re: Clients losing connectivity to guest wireless network

Mark Elsen — Mon, 30 Sep 2024 09:32:28 GMT

- Start by upgrading to 8.10.196.0 , the last release for this model , and check if that can help,

Re: Clients losing connectivity to guest wireless network

Simon Blomqvist — Mon, 30 Sep 2024 10:04:00 GMT

I'm assuming you're doing CWA with ISE, correct? How are the guest authorization rules set up?

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 12:39:40 GMT

Correct. We are using CWA. The policy is in attachment.

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 12:40:38 GMT

I will try it as soon as I get the image for the WLC.

Re: Clients losing connectivity to guest wireless network

Simon Blomqvist — Mon, 30 Sep 2024 12:58:06 GMT

Okey, nothing wrong there with the authorization rules. How does the authorization profile WirelessGuest look?

Re: Clients losing connectivity to guest wireless network

MHM Cisco World — Mon, 30 Sep 2024 12:59:26 GMT

The client is roaming or not?

MHM

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 13:01:26 GMT

Client is not roaming.

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 13:04:53 GMT

The profile pics are attached.

Re: Clients losing connectivity to guest wireless network

MHM Cisco World — Mon, 30 Sep 2024 13:07:33 GMT

Then disable sleep mode or adjust the idle timeout

MHM

Re: Clients losing connectivity to guest wireless network

Simon Blomqvist — Mon, 30 Sep 2024 13:09:04 GMT

But those are the authorization profiles you've named WirelessGuestCWA_ISE1 and 2. How does the authorization profile that is named WirelessGuest look?

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Tue, 01 Oct 2024 07:07:19 GMT

Idle timeout is already set to 30 minutes.

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Mon, 30 Sep 2024 14:37:08 GMT

Here is authorization profile WirelessGuest in the attach.

The access list that is referenced on the profile contains standard access to the internet via the usual ports/protocols.

Re: Clients losing connectivity to guest wireless network

Derrick Hurley — Mon, 30 Sep 2024 15:49:56 GMT

What does the ISE live log look like for one of the authentications?

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Tue, 01 Oct 2024 07:15:32 GMT

Here are the pictures of the detailed view from the live log for one authorization. All authorizations look the same in the logs.

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Wed, 02 Oct 2024 06:53:37 GMT

I managed to upgrade the WLC to the latest recommended version but the situation remains unchanged. The guest clients keep de-authenticating within 10-20 seconds of authorizing on the network.

The users remain connected to the network but need to re-enter their credentials.

Re: Clients losing connectivity to guest wireless network

MHM Cisco World — Thu, 03 Oct 2024 15:50:18 GMT

debug client <mac address>

Share this for any client loss connection

MHM

Re: Clients losing connectivity to guest wireless network

Rich R — Fri, 04 Oct 2024 13:31:46 GMT

1. Have you checked your WLC config using the Config Analyzer (link below)?

2. Do you have CoA enabled and working on the WLC so that ISE can send CoA to the WLC? Are your firewalls and ACLs allowing the CoA to reach the WLC?

Re: Clients losing connectivity to guest wireless network

igor.hamzic81 — Fri, 04 Oct 2024 14:11:22 GMT

I have done the debug for one client and I think that I'm either hitting the bug CSCwa20143 or there is some weird interection between ISE and WLC for client timeout.

After removing session timeout on the WLC(was set to 28800s) the client connection is stable.

Altough I would like to keep the session timeout as a security measure as this is a guest network.

The logs from the WLC are attached.

Re: Clients losing connectivity to guest wireless network

Rich R — Fri, 04 Oct 2024 15:01:24 GMT

Interesting - don't think I'd seen that bug before.
And thinking about it we might have seen something similar to this before too, a while back, and couldn't explain it.
Next week I'll have a closer look at the one where we had the issue reported.