WLC & ISE - MAC Addess instead of username

[olivermatt1]

Hi all,

we've set up a User Guest Portal with Cisco ISE 2.4 Patch 7 and a Cisco WLC 5520 running on Version 8.5.140 (MR4). The WLC and ISE are configured according to the Cisco Guide "ISE Guest Prescriptive Deployment_Guide".

So far everything is working fine and the users are able to access the internet through the ISE guest portal.

The only thing that bothers us is the client display on the WLC. Instead of the username we only see the MAC address of the client as a username. I've found and old discussion on this board regarding this issues, saying that this problem should be solved with ISE 2.4. Is this true or does this problem still exists?

Any help on this topic would be fine.

Thank you in advance

Oliver

[Jason Kunst · Accepted solution]

Yes this is mentioned in the guide under remember me section, there is a link to a community post with defects on the wlc display issue. Please get a case attached to these defects

[Jason Kunst]

https://community.cisco.com/t5/security-documents/ise-2-3-remember-me-guest-using-guest-endpoint-group-logging/ta-p/3641150

CSCvh04231 & CSCva66612 Enhancement for future, please reach out to our Product Managers via - http://cs.co/ise-feedback Guest remember me radius accounting and access accept not sending guest username

[olivermatt1]

Hi Jason,

thank you for your prompt answer. Just to make sure: You want met to open a TAC case regarding this issue (as it is suposed to work with ISE 2.4) and submit an ISE enhancement request through the ISE Web-GUI?

Kind regards

Oliver

[Jason Kunst]

Yes please. Trying to get this prioritized. Attaching a case to the defect is good and also submitting issue via http://cs.co/ise-feedback

[olivermatt1]

Hello Jason,

I got some feedback from TAC about my WLC/ISE display issue. TAC explained that since we are using MAB authentication in the first step om the WLC (required by the ISE guest portal) it is normal that only the MAC addresse of the client is displayed in the WLC Client overview.

I assumed that it works like this (streamlined overview):

1. The User signs in on the Guest WLAN SSID
2. The user gets authentificated by MAB
3. The user will be forwarded on the ISE Guestportal
4. The user signs in on the ISE Guestportal
5. The ISE will authorize the user on the WLC via AAA Override (CoA)

From point 5 the username should displayed on the client overwiev of the WLC Controller. Correct?

Can you please shed some light on this? It would be kind of cumbersome if I have to correlate the WLC client display with the ISE log to get the user information.

Kind regards

Oliver

[Jason Kunst]

Please see the prescriptive guest guide at http://cs.co/ise-guest it explains this under remember me section. There is also a community post about this.

https://community.cisco.com/t5/security-documents/ise-2-3-remember-me-guest-using-guest-endpoint-group-logging/ta-p/3641150

Recommend attaching to these defects
· CSCvh04231<> & CSCva66612<> Enhancement for future, please reach out to our Product Managers via - http://cs.co/ise-feedback Guest remember me radius accounting and access accept not sending guest username