topic Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE in Wireless

WLC 5502 Not Sending Message-Authenticator Attribute to ISE

Vinicius Monteiro — Mon, 25 Nov 2024 12:57:17 GMT

Hello team, I hope you're well

I have a problem that when I enable the Require Message-Authenticator Attribute in the ISE, the network that uses the guest portal stops working because the ISE drops all connection requests because it does not have the Message Authenticator, however in the other WLCs I do not have this problem, only in this 5502, has anyone experienced this and gotten a workaround? I have already checked the settings between the wlcs in order to find any difference and enable, but I have not identified it

WLC Version 8.3.150.3

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

Mark Elsen — Mon, 25 Nov 2024 13:10:35 GMT

- As per https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html
you should first upgrade to 8.10.196.0 and try again , 8.3.x is very old ,

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

MHM Cisco World — Mon, 25 Nov 2024 13:18:50 GMT

require Message-auth <<- dont select this op in ISE and I think it will work

MHM

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

Vinicius Monteiro — Mon, 25 Nov 2024 13:51:21 GMT

Hi guys, @Mark Elsen and @MHM Cisco World thanks for the suggestions

Just to clarify in this environment I cannot apply an update as there are APs that are not supported in version 8.10 and not checking the option is also not an option as I am trying to mitigate CVE-2024-3596 Blast Radius, which ISE is vulnerable to

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

Mark Elsen — Mon, 25 Nov 2024 14:00:49 GMT

@Vinicius Monteiro wrote : >Just to clarify in this environment I cannot apply an update as there are APs that are not supported in version 8.10
- This should be considered a fatal showstopper these days ; the aireos models are EOL and using the last release made available has become mandatory for this type of controllers. If not being able to use the extra features because of a bug then there is nothing more then (anything more) then you can do , besides going back and not using that feature.
If the restriction is due to certain older AP models , that also means that it is time to modernize the wireless network ,

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

MHM Cisco World — Mon, 25 Nov 2024 14:11:03 GMT

disable Op of allow protocol will apply to these AP only not all device

MHM

Re: WLC 5502 Not Sending Message-Authenticator Attribute to ISE

Rich R — Tue, 26 Nov 2024 08:43:23 GMT

@Vinicius Monteiro as per https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/222287-blast-radius-cve-2024-3596-protocol-sp.html not all radius clients will send message authenticator on all requests and the option should only be enabled where you know that the radius client will always use message authenticator.

As per https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk70846 AireOS will only send message authenticator for EAP authentication flows which is strictly compliant with RFCs at the time of implementation. AireOS is end of life and this will not be changed (and certainly not ever in 8.3.x which is years past end of support!). As per the bug notes - if you need to protect that radius traffic (if it is exposed to interception for example across the internet) then you should transport it in IPSEC. If the radius is only transmitted across secure network links and devices (which you control and which should not be exposed to interception) then there is no real risk to start with. In that case you add it to your Risk Register and note that it is mitigated by transport over secure, controlled networks. If that's not good enough for your security team then ask them for the cash to upgrade all the equipment to current, supported technology.

> however in the other WLCs I do not have this problem, only in this 5502
I presume you mean 5520?
Are the other WLCs running the same version of code?
Are the radius flows all identical? (for example maybe the others are EAP?)