CoA - WLC to ISE in DMZ

[robbyde0100]

Hello,

We have a PSN node in our DMZ that acts as a guest portal for our guest SSID.

I've had reports that when users enter their U&P to the portal it wont connect to the internet i.e. it wont drop the ACL.

I've checked the radius logs and can see the following:

	11204	Received reauthenticate request
	11220	Prepared the reauthenticate request
	11100	RADIUS-Client about to send request - ( port = 1700 , type = Cisco CoA )
	11104	RADIUS-Client request timeout expired (Step latency=10005 ms)
	11213	No response received from Network Access Device after sending a Dynamic Authorization request

We have UDP port 1700 open on our FW between the WLC and the PSN so I dont think its being blocked but is there a WLC command I can use to check? 

Or should/can I tweek the timeout period?

Also I'm a little confused if the port needs to be open between the WLC and the PSN or the AP and the PSN?

Unfortunatley the site is in a different country so I cant test myself with a device.

We're running ISE 2.6 patch 7.

WLC 8.5.161.0

Thanks

[Mike.Cifelli]

Not sure if you are using flexconnect or Local mode APs, but here are a couple of things to check/keep in mind if using local mode:
-The acl you want applied needs to be configured on the WLC (Security->Access Control Lists) and then referenced in your ISE authz profile under Airespace ACL Name
-Make sure on your WLAN that you have enabled AAA override option so that dynamic auth is accepted from ISE
-Make sure you enable support for CoA

[robbyde0100]

Hello,

Thanks for the reply Mike.

I'm running flexconnect.  I'm pretty certain my setup is correct and it all works, its just occationally for some devices I get the error.

I'm not sure if CoA is just timing out or its something else.

[Damien Miller]

Check two things.
1. Does the WLC receive the COA sent from ISE? If yes, you would see it in the WLC debugs and a new authentication in the live logs.
2. If the WLC receives the COA, it sends a COA acknowledgement back to ISE, you need to make sure this packet is able to return back or ISE will show that the COA failed even if the COA was successful.