EAP Issue

[fatalXerror]

Hi,

I was searching the internet that maybe lead me for EAP timers best practices for WLC because currently some of the endpoints is having issue connecting and based on ISE logs, it shows "Endpoint Abandoned EAP Session and Started New" and I believed it is because of some timers that we need to tweak.

I suspect it is because of the WLC EAP timers located in Security > EAP Advanced because endpoint is having a hard time to response fast enough ISE. Do you which are the best practice value that we need to enter in that parameters.

Thanks

[Rob Ingram]

Hi,

Checkout this Cisco Live presentation (page 87), it covers the WLC radius configuration and best practices amongst other things. Potentially increasing the RADIUS Server Timeout from default 2 secs to 5 secs might help with your issue.

HTH

[fatalXerror]

Hi @Rob Ingram, all settings I saw in the Cisco Live slides are the same in my deployment. I am suspecting it is an endpoint issue but I cannot point out where in the endpoint it is, either the OS or the driver. 

The thing is, most of them are able to connect with no issues but they have the same OS and driver version installed.

Do you have any idea where to look at for this endpoint?

Thanks a lot.

[Nidhi]

It could also be a supplicant issue !

I suggest taking captures to analyze this and also please raise a TAC case. 

Thanks,

Nidhi 

[Arne Bier]

The RADIUS timers from the BRKSEC presentation may be a red herring - tuning from 2 to 5 seconds just makes the WLC more tolerant when expecting an ACK from the RADIUS server.  5 Seconds is a long time.  And this applies to all RADIUS requests, not just EAP. I'd be wary of tuning this too long - more than 5 seconds doesn't make sense in a typical enterprise.

The EAP protocol layer has its own timers.  And this is potentially where the issue lies.  example from a Cisco WLC

Apart from the fact that if a supplicant stops communicating back to ISE during an EAP session establishment, then ISE will also finally give up and throw a warning.  I think this is quite normal, e.g. when a client walks out of the building and out of range of the WiFi.  If however you are stationary and in clear sight of the AP, then this of course is not normal.