cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1723
Views
2
Helpful
15
Replies

ISE Guest accounts stop working after 21 days

Cliffer
Level 1
Level 1

Hi team!

We have been struggling with an issue after migrating our ISE deployment from 2.6 to 3.1 last year.

We found out that accounts used for Wifi guest solution stop working properly after 21 days of being created using the Sponsor portal.  The behaviour is that the user cannot navigate anymore and this is how it looks from Guest Accounting reports page:

Cliffer_0-1709901869426.png

From a policy perspective, the attempt seems to get stucked at the CWA redirection and we couldn´t find anything relevant on the Live logs, except that compared to a working device, Step 15048 doesn´t appear for a non-working device.

Cliffer_1-1709902238175.png

This happens to any kind of device and once the account stops working, it doesn´t work anymore until we create it again.  On the Sponsor portal, the accounts are not locked or expired.

We use AD for authentication and another strange behaviour is that some accounts are not able to creat guest accounts which work, even if they are on the same AD group.

Any help or suggestion will be much appreciated.  I could provide more details but didn´t want to make it very extensive.

Thanks.

15 Replies 15

Yes, we found out that after migrating the ISE, it was sending a timeout session very very big (a couple of millions), when that option wasn´t enabled on the ISE.  Forcing the timeout session on ISE or disabling that option on the WLC, solved the issue.