06-19-2019 06:56 AM
Hi All,
We have a Cisco ISE cluster with 4 nodes and using CoA for Wireless. Thats working fine.
The goal is to use CoA for switchports too and configured both ISE and the switch for CoA (default port). After initiating a CoA from ISE to a specific client (switchport) we found that the CoA is never recieved by the switch.
After creating and anlysing a TCP dump on the (right) PSN we found that ISE is never sending the CoA.
Below a screendump from the TCP dump with a full authentication.
Direct after this authentication the CoA is send but its not found in the trace.
Any ideas?
Solved! Go to Solution.
06-21-2019 01:56 AM
Problem has been solved!
In the TCP dump of the PAN we found intercluster CoA traffic (from PAN to PSN) on UDP 3799. This traffic was not arrived at the PSN because all intercluster traffic is firewalled. After opening UDP 3799 between all cluster nodes the PSN is sending CoA to the switch on UDP 1700.
As far as I can found in the documentation intercluster CoA traffice should be send at UDP 1700
https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/425001-426000/425863.jpg
So intercluster traffic on UDP 3799 is not as designed!
Thank you all for helping
06-19-2019 07:47 AM
06-20-2019 12:45 AM
Make sure you have nothing blocking UDP/1700 (ACL ,FW ..)
Do you get a CoA error in the live logs ?
06-20-2019 12:59 AM - edited 06-20-2019 01:00 AM
There is one FW and one ACL on the path between ISE and the switch. But both have no blocks and permit UDP 1700.
The log on both shows also no UDP 1700 traffic.
Yes, we receive an error in the ISE log
06-20-2019 12:54 AM
Mike, thanks for your suggestions.
All of the suggested configurations are present. The debugs do not give any results becuase the packet is not send by ISE. The TCP dump on the ISE network interface shows zero CoA packets, so it should be an ISE issue.
06-20-2019 03:49 AM
Run a debug on runtime-AAA to see if ISE is sending CoA.
If you still cant get resolution please open a TAC case for further troubleshooting.
06-21-2019 01:56 AM
Problem has been solved!
In the TCP dump of the PAN we found intercluster CoA traffic (from PAN to PSN) on UDP 3799. This traffic was not arrived at the PSN because all intercluster traffic is firewalled. After opening UDP 3799 between all cluster nodes the PSN is sending CoA to the switch on UDP 1700.
As far as I can found in the documentation intercluster CoA traffice should be send at UDP 1700
https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/425001-426000/425863.jpg
So intercluster traffic on UDP 3799 is not as designed!
Thank you all for helping
10-28-2019 06:15 AM
Hi,
Interesting information, thanks for sharing.
Which ISE version are you using ?
Indeed, UDP 3799 is not one of the flows that need to be opened for the cluster to work (based on the documentation).
I have a scenario with load-balanced PSNs where this behaviour would be interesting.
02-04-2020 01:07 PM
Hello,
Even if your problem is solved, take a look here :
(CISCO ISE Policy Service Node ports / Session) :
|
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: