Dynamic Authorization failed Failed

[henokk60]

Hi All,

We've enabled and configured posture assessment at our HQ and branch sites, each with a different WLC. The HQ WLC is functioning correctly, but the branch WLC is consistently logging the alarm 'No response received from Network Access Device after sending a Dynamic Authorization request.' Additionally, users at the branch site get stuck on an 'Action needed' posture state for an extended period after authentication. I've already investigated and ruled out common causes found on Cisco Community forums, such as incorrect NAD IP addresses or shared secrets, network connectivity issues, and NAD configuration for Dynamic Authorization. All these settings appear to be configured correctly and also check the HQ and branch WLC configuration and it is the same. 

Please if anyone got the same problem and how to resolve the issue please assist me 

Thanks,

[marce1000]

  - @henokk60     What version of ISE are you using ?

   M.

[henokk60]

Hi @marce1000  My ISE version currently is version 3.3 Patch 7

[PSM]

COA on branch WLC is failing all the time or is it an intermittent issue ? Have you added all the PSNs in dynamic author client list with correct radius secret of WLC radius configuration ? Also is there any firewall on the network path between ISE and WLC ? If yes make sure UDP 1700 port has been whitelisted on the firewall from ISE to NAD(WLC)

[henokk60]

@PSM The issue is intermittent. I've checked the latency, and it is 1ms, which is within an acceptable range. The shared secret key has been verified and matches, and there is no firewall between the devices that would block the traffic.

[MHM Cisco World]

from WLC use WMI interface (interface you use in radius group) 
ping to ISE to check 
1- MTU size it support, dont forget use df bit 
2- latency

also if there is FW check 1700 port is open or not 

MHM 

[MHM Cisco World]

latency is OK 
no FW 
share the packet capture between WMI and ISE 
to know how packet capture use check below link

https://youtu.be/7TXVqm3Rpmw?si=PEAUIr6E3IA_9ueB