topic Does the anchor controller in Wireless

Guest WLC not talking to ISE it is in a DMZ

Mark Jensen — Mon, 05 Jul 2021 08:28:32 GMT

I have allowed all IP to the ISE servers from the DMZ the Guest 5508 WLC sits. I see requests coming in from a WLAN configured on the inside WLC but nothing from the SSID that comes from the WLC within the DMZ it is a mobility anchor for the guest network on all my WLC's. What needs to be opened for this communication? or will the mobility anchor type setup not work in the ISE world? I have uploaded the config of the guest WLC we are on 7.6.130

According to the config you

Stephen Rodriguez — Tue, 02 Sep 2014 17:01:13 GMT

According to the config you posted, you do have an ACL configured, but i don't see it applied anywhere.

Is the WLC really in the DMZ? and if it is, are you allowing the mgmt subnet back through the firewall?

HTH,

Steve

Yes it is within a DMZ, the

Mark Jensen — Tue, 02 Sep 2014 17:58:52 GMT

Yes it is within a DMZ, the ACL isnt applied to this wlan yet as we are in testing phase. In ISE I see requests coming from a WLC within the network, this WLC passes guest traffic to the WLC in the DMZ the WLC has all IP Open to the ISE servers. Looks like a simple radius config but is there some other protocol needs to be let thru?

if you are allowing all IP

Stephen Rodriguez — Tue, 02 Sep 2014 18:02:07 GMT

if you are allowing all IP from the WLC, I'd check the FW and make sure you are allowing that communication to go through.

HTH,

Steve

Does the anchor controller

Mark Jensen — Tue, 02 Sep 2014 18:44:18 GMT

Does the anchor controller send this request? I see nothing from teh WLC thru the monitor in my ASA firewall for any WLAN traffic. Only talking back to the other controllers. I'm confused over how this traffic flows, the main WLC holds the SSID's the Guest is handed off to the Guest controller thru the mobility but does the request to the radius or ISE servers come from the guest controller or the main controller the AP's belong to?