Hi All,
I have following issue. We are running ISE 2.7 Patch 2 and recently one of our distributed PSN's used for Guest portal had its interface configuration update to use Bond 1 instead of its original Gig3 interface. Gig3 was cleared and IP moved to Gig2 and Gig3 setup as backup as per configuration guides. What was not noticed is that ISE services on this node stayed in " not running " state until I was asked to test post change implementation. At this time all endpoint authentication was passed over to another PSN, it did not had any interfaces configured, expected errors stating that were received. Ended up starting services on original node and confirmed that all wireless guest portal authentications are happening against intended PSN node.
The issue: Endpoints connect to the SSID and get prompt for login, user types in username and password and on success page it should redirect to companies website, I briefly see the url it tries only to get back to login screen. URL redirect loop in its full glory.
9800 WLC is configured with ACL used in redirect AuthZ Profile and URL is correct where it is redirecting to, so new Bond 1 interface config appears to be working.
WLC has NAC and aaa-override configured, aaa accounting is in place, CoA configuration is configured correctly, aaa servers shows to be working. Live logs show that CoA after authentication success has been successful.
What I am however not seeing is that MAC address of the endpoint gets statically configured with GuestEndpoints endpoint identity group which we have used in portal as Guest Type config where to place the MAC into and gets further used in AuthZ sitting above rule which is doing the redirect. AuthZ rule conditions state if in GuestEndpoints and its is Wireless_MAB for matching.
Have already raised TAC case but they stated it will take them days to review and come up with solution. Other posts discussing similar loop do not state issues with endpoint static group membership, other than changes to interface nothing else has been changed.
Things done so far:
• WLC has been re-provisioned from DNAC so same config templates have been applied.
• We have performed full resync from deployment section in ISE for the node which had its services in "not running" state after change and node has been rebooted.
• We have tried using new endpoint identity group where MAC gets placed into and had corresponding AuthZ rule for it above the redirect rule
• Have restarted services and node which is current primary PAN as its is its responsibility for guest flows to work.
• I have run endpoint debug at the time of the issue and did see that Attributes stated identity group static assigned as GuestEndpoints, but at the same time I do not see mac in endpoints section at all as all tests are usually carried out by having device forget the network, terminate session from ISE and deleting the MAC from endpoints.
What else is left to check? Advice would be appreciated.
