topic Re: CWA intermittent issue in Wireless

CWA intermittent issue

thms — Tue, 14 Apr 2026 09:34:03 GMT

Hi all,

First time posting here.

I’m facing an intermittent issue with CWA on a Cisco Catalyst 9800 (17.12.4) and packetfence, only impacting FlexConnect deployments, central switching works fine.

Issue:
About once a week, can happen more than once though, CWA breaks:

Clients connect to the SSID but show “no internet”
No redirection to the captive portal
No clear errors or relevant logs

Observations:

Modifying the redirect ACL even just a description immediately restores service
QoS policy changes can trigger the issue
An EEM ACL refresh helps as a temporary workaround, but because the failure is silent and generates no usable logs, I have to rely on a daily cron job, which still impact the end users.

Troubleshooting:

Client trace shows no anomalies
Logs seen in some cases: Redirect ACL failure / Authorization failed but not during failure window

Questions:

Known bugs in 17.12.4 related to CWA / redirect ACL / FlexConnect?
Possible ACL/policy desync between WLC and AP?
Recommended debugs to catch this during failure?

Thanks in advance

Re: CWA intermittent issue

Mark Elsen — Tue, 14 Apr 2026 10:44:03 GMT

- @thms No direct insights here , but also relating to intermittent issues ; have a try with the
latest advisory for 17.12 ,= 17.12.6a

Re: CWA intermittent issue

thms — Tue, 14 Apr 2026 14:49:38 GMT

@Mark Elsen that's not currently possible as there are still some APs in our infrastructure that don't support version 17.12.6a

Re: CWA intermittent issue

Mark Elsen — Tue, 14 Apr 2026 15:07:31 GMT

- @thms Yes they will , let me clarify , all your access points working on the current
17.12 release will work with 17.12.6a ; cisco did no longer update the compatibility
matrix after 17.12.3 because the versions after .3 where not sufficiently back tested
on the older access points (also using 17.12.x). But that has no impact

Re: CWA intermittent issue

thms — Tue, 14 Apr 2026 15:07:44 GMT

@Mark Elsen I checked this compatibility matrix and did not find the series of some of the APs that are still in our infra, do you suggest I go ahead and update to version 17.12.6a ?

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html#:~:text=Cisco%20IOS%20XE%2017.12.6a

Re: CWA intermittent issue

Mark Elsen — Tue, 14 Apr 2026 15:19:47 GMT

- @thms Yes . they are omitted in that Table , for the reasons I previously explained

Re: CWA intermittent issue

thms — Wed, 15 Apr 2026 08:49:14 GMT

@Mark Elsen I will do some testing in a lab environment and will get back to you if the issue is resolved.