CWA Flexconnect Preauth ACL not applied.

[ecarbajo]

Hello, I have a WLC-7510 version 8.5.151.0 and AP models AIR-AP1832I and IW3702.

After upgrade from 8.2.151.4 to 8.5.151.0, we have the following problem:
Sometimes clients are not redirected to captive web portal.

Same client, same AP, sometimes it works, sometimes fails.
We see in a sniffer trace, that when it fails, traffic to the web portal is going tunnelized in CAPWAP to the controller, instead going directly to the portal server( his IP address is in the Preauth_ACL ).

When it works, we see at the end of "show controllers dot11Radio 1 client xx:xx:xx:xx:xx:xx" command in the AP, it appears the preauth ACL:

.....
webauth done:
false
webauth preauth acl:
allow true and dst 93.191.138.50 mask 255.255.255.255,allow true and src 93.191.138.50 mask 255.255.255.255, ...............

But when it fails, there's nothing below "webauth preauth acl".

Executing a "debug client 00:cd:fe:d3:34:23" on the AP, there's a difference when it fails, it appears the messages:

Nov 20 13:23:04 syslog: failed writing /click/client_ip_table/set_cli_capwap_webauthdone len 22 data: "0:CD:FE:D3:34:23 false"
Nov 20 13:23:04 kernel: [*11/20/2019 13:23:04.2730] !!!!! {/usr/sbin/capwapd} failed writing /click/client_ip_table/set_cli_capwap_webauthdone len 22 data: "0:CD:FE:D3:34:23 false"

Has anyone seen this bug?

[Rich R]

No but it looks like a possible match for https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh61996 https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg38779 https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm18063
It looks like Cisco are treating the first 2 as low priority (sev 4) but CSCvm18063 is fixed in ap-16.11.1.3, 8.9(100.0), 8.9(1.134).
Give one of those a try and if no luck then you'll need to open a TAC case.
Judging by the logs (referring to click) and the bug notes this bug seems specific to ClickOS APs (wave 2) so I'd be surprised if you see it on a 37xx AP.

Regards
RR

[ecarbajo]

Thanks,  RR,

I can't upgrade the 7510 WLC, because the last release for this platform is 8.5.151.0 .

I have tried in the lab using a vWLC:   with vWLC 8.5.151.0,  the problem is reproduced.   But with vWLC new version 8.10.105.0,  it works fine.

[Polo Yisus]

Hi,

if you were able to reproduce this on your lab and you got same result on version 8.5.151.0, please open a TAC case and you would have a new bug for this on version 8.5.151.0

[Rich R]

Polo that would be pointless - CSCvm18063 already covers 8.5 code!
He could ask TAC to escalate it to BU in hope of getting it fixed in next 8.5 MR but since MR6 is already in beta will probably miss MR6 and therefore likely wouldn't be for some time to catch next MR (if there is one) if BU agree to fix it in 8.5. Having another case attached to the bug would strengthen the business case for getting it fixed.