cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

2068
Views
0
Helpful
3
Replies
dpicomms
Beginner

ACS 5.0 RADIUS timeout with WLC 7.0

Hi Guys,

I am configuring a Cisco Secure ACS 1120 appliance running ACS 5.0.0.21 to handle RADIUS request from a Cisco WLC 5508 appliance running version 7.0.116.0.

  • these devices have open communication on all ports - no firewalls or ACL's
  • they have successful ping communication

The following statements illustrate some but not all the debugging I have done to ensure each device functions as it should in isolation.

  • Using a simple windows RADIUS server (radserv2.exe) instead of the Cisco ACS 
    • This works and the WLC gets RADIUS response from my makeshift server
  • Using a simple windows EAP client to query the ACS using RADIUS protocol  
    • this works and the ACS processes the RADIUS request and sends a response
  • Placed a wireshark client on the network to inspect timeout.
    • Wireshark logs the packet from the WLC to the ACS using port 1812 but doesn't see any packet  responses from the ACS

At the moment I have the

  1. WLC accepting the association from the wireless client and
  2. sending the RADIUS (PEAP, EAP-FAST or EAP-TLS) request to the ACS,
  3. the WLC receives no response and generates a timeout message and disassociates from the client.
    1. note this is not a reject or similar message, the ACS simple does not even process the packet. i.e. there is absolutely nothing in the ACS logs to suggest it even received a radius packet from the WLC.

In summary the WLC and the ACS successfully function independently but they do not communicate via radius.

Any assistance appreciated Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

It seems as though you are using ACS 5.0 without any patches.

For your information the product release is now up to 5.2 and ACS 5.3 is soon to be released

I seem to remember there was an issue with ACS 5.0 operations with WLC that was resolved in patch for 5.0

I am not sure of the specific CDETS but may be:

CSCsy17858 Incorrect handling of Tunnel-Type & Tunnel-Client-Endpoint attrs

ACS 5.0 has a cumulative patch appraoch with all fixes being accumulated

My recommendation would be to download patch 8 for ACS 5.0: 5.0.0.21.8

Patch can be downloaded from CCO

To install a patch define a repository on ACS (cumulative patches are larger than 32MB so you can't use TFTP for this), copy the patch file to the repository, then on ACS' CLI:

# acs patch install repository

View solution in original post

3 REPLIES 3
Javier Henderson
Enthusiast

Check the service selection screen, is the RADIUS policy being hit at all?

It seems as though you are using ACS 5.0 without any patches.

For your information the product release is now up to 5.2 and ACS 5.3 is soon to be released

I seem to remember there was an issue with ACS 5.0 operations with WLC that was resolved in patch for 5.0

I am not sure of the specific CDETS but may be:

CSCsy17858 Incorrect handling of Tunnel-Type & Tunnel-Client-Endpoint attrs

ACS 5.0 has a cumulative patch appraoch with all fixes being accumulated

My recommendation would be to download patch 8 for ACS 5.0: 5.0.0.21.8

Patch can be downloaded from CCO

To install a patch define a repository on ACS (cumulative patches are larger than 32MB so you can't use TFTP for this), copy the patch file to the repository, then on ACS' CLI:

# acs patch install repository

View solution in original post

issue resolved by upgrading from 5.0 to 5.2, Thanks for the help!

Content for Community-Ad