ISE WLAN Controllers Best Practises

[Marcin Zgola]

I have a customer and large deployment of ISE. They have 100s of WLAN controllers in different parts of the world.

We experience occasional connectivity problems. The problem is on Wireless site, as clients can't successfully authenticate to get on the wireless network. 

I am not Wireless Expert, but I see things like:

1. FAST SSID Change Enabled and Disabled on some controllers

2. SSID Broadcast Select, but WLAN Anchor Controllers do not have this checked.

3. Aironet IE enabeld and disabled

4. Authentication and Accouting Servers enabled and disabled on some Anchor Controllers.

My question is : is there a best practise document out there, what is the optimal and best Wireless configuration for ISE to do CWA, and 802.1x with Posture.

Thank you

[Gagandeep Singh]

Hi,

CWA document for reference:

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

ASA Version 9.2.1 VPN Posture with ISE Configuration Example

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117693-configure-ASA-00.html

Regards

Gagan

rate if it helps!!!!

[nspasov]

Hello Marcin-

I would suggest you check out the following Cisco Live Session:

BRKSEC-3699 - Designing ISE for Scale & High Availability

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=90923&tclass=popup

There is tons of good info there but more importantly, the slides include best practices for the different NAD types including WLCs. 

I hope this helps!

Thank you for rating helpful posts!

[antmatrix]

The four items listed wont cause/fix the issue you explained. Fast SSID should be enabled if user switches between different SSID often and wlc anchors don't broadcast SSIDs the foregien controller does so that setting is correct.

What does the Prime logs say for the clients that failed authentication?