topic Re: WLC9800 COA in Wireless

WLC9800 COA

hs08 — Fri, 22 May 2026 07:56:10 GMT

I make ssid for guest where the user should enter the captive portal and enter the entra id user to acess to guest network. The environment used is WLC9800 and FortiNAC. When the user login to the SSID then the user will enter to isolation network to access the captive portal and after entra id successfull the from fortinac i can see the user already move from isolation to guest network but actually the client still sit under isolation network.

Based on this picture can we say that fortinac not send the CoA to the WLC?

Re: WLC9800 COA

Mark Elsen — Fri, 22 May 2026 08:59:12 GMT

- @hs08 Do you have COA enabled in the WLC 9800 configuration as in :
aaa server radius dynamic-author
client <FortiNAC-IP> server-key <key>
and
radius server FORTINAC
address ipv4 x.x.x.x auth-port 1812 acct-port 1813
key XXXXX
automate-tester username test

Also make sure to enable : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/wlan-security.html#info-aaa-over

Troubleshooting commands :

# Show wireless client summary
show wireless client summary

# Show client detail
show wireless client mac-address <MAC_ADDRESS> detail

# Show RADIUS server status
show aaa servers detailed

# Show AAA method lists
show aaa method-lists all

# Debug RADIUS transactions
debug radius all

For : show aaa servers detailed
Look for stats after Author:

+ Use full client debugging according to : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
Client debugs , so called Radio Active traces can be analyzed with : Wireless Debug Analyzer

Re: WLC9800 COA

aleabrahao — Fri, 22 May 2026 10:26:17 GMT

Check on the WLC if the dynamic-author (CoA) server is configured.

Example of required configuration:

aaa server radius dynamic-author
client <FortiNAC_IP_IP> server-key <secret>

Check the real-time CoA statistics by running the following command during the test:

show aaa servers dynamic-author

Debug on the WLC with the commands below:

debug radius coa enable
debug aaa all enable

If nothing appears during login, no CoA is being received.

Re: WLC9800 COA

hs08 — Fri, 22 May 2026 14:00:57 GMT

hi @aleabrahao , @Mark Elsen

I have coa enabled on the wlc, here my config

I can't do the debug right now since i'm at home and will share the log on Monday.