topic Re: Issues on posture enabled SSID in Wireless

Issues on posture enabled SSID

hdshamal26 — Mon, 04 Nov 2024 08:19:31 GMT

Hi,

We have one posture enabled SSID in our wireless network. It is not seamlessly work compared to other SSIDs. The main difference is posture feature has enabled on it. Below are the list of issues. Please share your experiences to overcome from these issues.

1. Globe icon is not changed to the WIFI icon soon after user connected to the SSID. It will take time to change the icon after the posture process completed. Though the icon doesn't change user has access to the network (Both intranet & internet via proxy)

2. Connected to the SSID. But "No internet" massage appeared. At this time no internet access even after ore than 5 minutes.

3. "Action Needed" when user connected to the SSID it prompt "Action Needed for <SSID name>". Though this is appeared some times user have access to the network. Some times not.

4. Users are experiencing sudden disconnection from the SSID.

Re: Issues on posture enabled SSID

Mark Elsen — Mon, 04 Nov 2024 08:25:38 GMT

- You can for instance , check the ISE live logs when a client connects and then verify if according to posture sequence executed , that access is granted or rejected,

Re: Issues on posture enabled SSID

srimal99 — Mon, 04 Nov 2024 11:50:27 GMT

You can check the radius live logs, and check against the authorization rule are matching accordingly.I have had similar issue anyconnect not joined but ise logs shows client connected.
There are some cisco ISE videos below for your reference;
https://www.youtube.com/watch?v=AxgtXynug_E
https://www.youtube.com/watch?v=14ozZzOE_zM

Re: Issues on posture enabled SSID

Rich R — Mon, 04 Nov 2024 16:50:44 GMT

Not enough detail provided to say for certain but I'd guess this is related to radius CoA not reaching the WLC or not being allowed.
Have you enabled CoA and allowed it through ACLs and Firewalls?
In wireless profile policy "aaa-override"
"aaa server radius dynamic-author" must include all your radius server(s)
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html#toc-hId--1639616132

Source Device	Destination Device	Protocol	Destination Port	Source Port	Description
RADIUS server	WLC	UDP	1700	0::65535	CoA radius packets