Allowing access if ISE is down in Wireless

[EdouardZorrilla0939]

Greetings,

Could you advise how to set fail open in the 9800 WLC when ISE is down ?

Thanks,

Edouard.

[Amine ZAKARIA]

Hello,

You can create a Fallback SSID with Preshared-Key which is not used by RADIUS and disable it, until your ISE deployment goes down and enable it.

[EdouardZorrilla0939]

Hi Amine,

But the supplicant has already been set to use the certificate. You mean to create a fallback SSID with PSK using a different name.

Please advise.

[Amine ZAKARIA]

Hello,

Yes of course with a different SSID Name. 

[thomas · Accepted solution]

"Fail Open" is generally a bad security practice for wireless networks. Better to let people use Guest services for internet access.

Best is to simply deploy a highly available ISE deployment so this doesn't happen.

[EdouardZorrilla0939]

Thanks Thomas, Our design is ISE in HA mode and I wanted to know if was possible to failback from certificate-based authentication to PSK authentication in case both PSN are down.

I know it is possible in the wired scope, so I was wondering it was possible in the in wireless scope.

Thanks,

[howon · Accepted solution]

This is fancier than what you may be looking for as it only brings up the SSID in case ISE is down. This is important as if you have the backup PSK SSID always up, the user may favor it instead of the main 802.1X SSID:

https://community.cisco.com/t5/wireless-mobility-documents/automated-backup-ssid-with-eem-on-catalyst-9800-wireless/ta-p/3743838