12-12-2023 05:53 AM
Hello,
I am having a complicated issue, I am doing some test with the TAC but its a bit more than that I believe. Here is my problem, when you connect the the network the first time it work fine. If you click disconnect and reconnect it says ''Cant connect to this network'' every single time. you either have to reboot or wait 10m and try again it will work.
We have a SDA Fabric / Certificate auth for the corpo wireless. but it always work the first time, after 10m or after a reboot.
I did a radioactive trace from WLC. The success attempt is a 30-60s trace of the login and the failed one is the same. Success one is bigger size because I waited for the connection success and the failed one fails right away.
Thank you for the help in advance
**More info, The issue started 2 months ago, it worked perfectly before that. I did tons of OS-side troubleshooting but nothing works on the OS side it wont reconnect.
Solved! Go to Solution.
12-19-2023 07:21 AM
i'd advice to open case in TAC.
12-18-2023 11:07 AM
Can you upload the RA trace from the WLC with the failed attempt?
12-18-2023 11:22 AM
Sorry really thought I did... let me give you some context.
SuccessLogin is RA after a reboot, first connection
Second is after I hit ''Disconnect'' and ''Reconnect'' right away and it failed
but it also fail if I move in the building with the laptop it doesnt connect to other aps without a reboot or 10minutes without changing location
12-18-2023 11:37 AM
well... from this entry "
%DOT1X-5-FAIL: R0/0: wncd: Authentication failed for client (6449.7d7f.ec57) with reason (Cred Fail) on Interface capwap_9000000c AuditSessionID 11296E0A000747215E2CFB83 Username: host/L301043.******.org" it looks like endpoint fails to authenticate. do you have failed session record from ISE?
12-18-2023 11:57 AM
Yes this is the error I have but we use certificate authentication so there is no username-password to actually enter.
First time it work right away Certificate is fine but if you move in the building or disconnect-reconnect it gives this error
12-18-2023 10:48 PM
so do u have the failed log entry from ISE to share it here?
12-19-2023 05:04 AM
12-19-2023 06:40 AM - edited 12-19-2023 06:41 AM
Interesting case. u have rightmost output cut of pdf thus i can only guess about what is in use.
22072 Selected identity source sequence - ISQ_
22070 Identity name is taken from certificate attr
22047 User name attribute is missing in client ce
Subject - Common Name
looks like ISE complains on either the client certificate's attribute Subject CN is missing or contains wrong data. try to collect tcpdump of failed session on the PSN. you will find in the capture certificate sent by client. there should be CN= attribute & i guess it should look like hostname or FQDN.
12-19-2023 06:27 AM
Hello Andy,
I found something wierd, When I do the Endpoint debug, it suddenly work. I can connect/disconect/connect without any issues. as soon as I end the debugger the issue happen again it saays ''Cant connect to network''.
12-19-2023 07:21 AM
i'd advice to open case in TAC.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide