After succesful Web-Auth with ISE and WLC access internet delayed for about a min

[Akiva]

Environment

ISE Version: 2.6 patch 3

WLC AIR-CT3504-K9

version 8.5.140.0

Endpoint Windows 10

Related Configuration

Guest SSID created via wireless wizard, custom policy sets created to mimic the default policy set created by the wizard.

When a user connects to the wireless network they are redirected to the portal, after login in there is no internet access. After bout a minute internet access is obtained.

Optionally disconnecting and reconnecting the wireless you get internet immediately.

Anyone faced this, got a solution ?

[Jason Kunst]

It doesn’t say what type of portal it is

[Akiva]

Sponsored portal on ISE.

[craig.beck]

Possibly a CoA issue. Have you done any debugs for a client at the WLC?

Do you see the CoA in the RADIUS Live Log immediately after the client logs in?

[Akiva]

On the ISE logs am not seeing COA logs jumps from redirect policy to the policy that allows access (after a min/when disconnect and reconnect wireless on the endpoint)
Neither am I seeing any rfc3576 logs on WLC.
At some point came to think it may be ISE not triggering COA.

[Jason Kunst · Accepted solution]

I'd recommend using the TAC if you followed recommended wireless settings and the guest guide.

We don't see this in our setups with same code

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475https://community.cisco.com/t5/security-documents/ise-security-ecosystem-integration-guides/ta-p/3621164#toc-hId--488588311