topic Re: Wireless client IP acquiring delay in Wireless

Wireless client IP acquiring delay

komiks — Wed, 15 Jan 2025 13:35:03 GMT

we are integrating 9800 with ISE for posture check. we observed that when the client provisioning portal pops out because of the url redirection, the delay for the the wireless client to get production IP increases comparing if the url redirection is not working.

When url redirection is not working client acquires IP in less than 20 sec whereas when the redirection is working, i takes more than a minute.

Is there a way to make it faster?

Re: Wireless client IP acquiring delay

Flavio Miranda — Wed, 15 Jan 2025 13:48:07 GMT

@komiks

The delay is bigger when the communication is working because the traffic must go to ISE in oder to ISE reply with the redirect URL and we need to consider the WLC in between acting as a proxy for this traffic.

When the communication is not working and you are not redirected, the traffic is not going to ISE. Would be like if you fallback from CWA to local redirect and on this case clients move to IP address discovery right the way.

Re: Wireless client IP acquiring delay

MHM Cisco World — Wed, 15 Jan 2025 13:52:43 GMT

I will send you PM

MHM

Re: Wireless client IP acquiring delay

komiks — Thu, 16 Jan 2025 00:44:16 GMT

Thanks @Flavio Miranda for the input. So the problem is, comparing to an old the WLC using aireos, it can achieve the faster delay with the url redirection working. I mean with aireos, the client device can get IP as fast as when the redirection is not working on the 9800.

Re: Wireless client IP acquiring delay

Flavio Miranda — Thu, 16 Jan 2025 00:57:46 GMT

@komiks Check how guest is configured in both WLC.

There is Local Web auth usually configured in older WLC and there is Central Web Auth used in newer WLC.

LWA the clients first get an IP address and then it is redirected to the portal (internal on the WLC or external) and then the authentication happens. On this mode, the process of getting IP address is way faster as the client need the IP address in order to call the portal.

And then we have CWA, which uses a Radius server for the authentication. On this mode. the clients does not receive IP address until it is authenticated, just like it happens in any radius process. The client will receive the portal guest url, will authenticate and after that it will receive the IP address.

Which means, in CWA, will take longer for clients get IP adderss.

Re: Wireless client IP acquiring delay

komiks — Thu, 16 Jan 2025 02:11:06 GMT

We are using CWA on both wlc, on the ise side, we are using the same policies for both wlc. on the process of posturing on the client, the difference is with 9800 takes longer to get the prod vlan IP.

Re: Wireless client IP acquiring delay

Flavio Miranda — Thu, 16 Jan 2025 09:31:04 GMT

You can use debug on WLC and ISE to track where the delay comes. Wireshark also helps on this case.

Ultimatelly, you can also open a TAC.

Re: Wireless client IP acquiring delay

Rich R — Tue, 21 Jan 2025 23:46:03 GMT

Why @MHM Cisco World