ACS 5.0 RADIUS timeout with WLC 7.0

[dpicomms]

Hi Guys,

I am configuring a Cisco Secure ACS 1120 appliance running ACS 5.0.0.21 to handle RADIUS request from a Cisco WLC 5508 appliance running version 7.0.116.0.

• these devices have open communication on all ports - no firewalls or ACL's
• they have successful ping communication

The following statements illustrate some but not all the debugging I have done to ensure each device functions as it should in isolation.

• Using a simple windows RADIUS server (radserv2.exe) instead of the Cisco ACS 
  • This works and the WLC gets RADIUS response from my makeshift server
• Using a simple windows EAP client to query the ACS using RADIUS protocol  
  • this works and the ACS processes the RADIUS request and sends a response
• Placed a wireshark client on the network to inspect timeout.
  • Wireshark logs the packet from the WLC to the ACS using port 1812 but doesn't see any packet  responses from the ACS

At the moment I have the

1. WLC accepting the association from the wireless client and
2. sending the RADIUS (PEAP, EAP-FAST or EAP-TLS) request to the ACS,
3. the WLC receives no response and generates a timeout message and disassociates from the client.
   1. note this is not a reject or similar message, the ACS simple does not even process the packet. i.e. there is absolutely nothing in the ACS logs to suggest it even received a radius packet from the WLC.

In summary the WLC and the ACS successfully function independently but they do not communicate via radius.

Any assistance appreciated Thanks

[Javier Henderson]

Check the service selection screen, is the RADIUS policy being hit at all?

[jrabinow · Accepted solution]

It seems as though you are using ACS 5.0 without any patches.

For your information the product release is now up to 5.2 and ACS 5.3 is soon to be released

I seem to remember there was an issue with ACS 5.0 operations with WLC that was resolved in patch for 5.0

I am not sure of the specific CDETS but may be:

CSCsy17858 Incorrect handling of Tunnel-Type & Tunnel-Client-Endpoint attrs

ACS 5.0 has a cumulative patch appraoch with all fixes being accumulated

My recommendation would be to download patch 8 for ACS 5.0: 5.0.0.21.8

Patch can be downloaded from CCO

To install a patch define a repository on ACS (cumulative patches are larger than 32MB so you can't use TFTP for this), copy the patch file to the repository, then on ACS' CLI:

# acs patch install repository

[dpicomms]

issue resolved by upgrading from 5.0 to 5.2, Thanks for the help!