5520 WLC & ISE CoA Issue

[Mike.Cifelli]

I am currently in the process of implementing ISE posture assessment on wireless nets.  I am seeing an issue when clients connect and posture status goes from Unknown -> Compliant.  The CoA sent from ISE to WLC is failing due to 'NAS Identification Mismatch'.  I have noticed that when clients first connect (status unknown) the NAS IPv4 Address depicted in radius live logs is that of the management interface from the WLC.  Then come time for ISE to issue the CoA after deeming a client compliant I see the NAS IPv4 Address depicted in the logs as the actual service-port IP of the WLC controller, which is used for actual device management (ssh/ui access, etc.).  This unfortunately is causing issues with clients moving from netA to netB upon posture change.  I am currently working the issue with TAC which is still unresolved atm.  However, I am seeking some guidance here on the following as both AAA TAC & I think the issue is due to WLC config:

-Is it possible to tweak a setting on WLC side so that radius packets are sourced from the actual MGMT interface(service-port), which would potentially aide in solving the NAS mismatch error?

FYSA: ISE2.7p3; WLC 5520 ver: 8.5.161.0; AAA & CoA is configured on WLC.  In non-postured scenarios client onboarding for eap-fast works perfectly fine.

[Rich R]

My first thought (but might not be relevant) ... do you have an explicit network route to the ISE via the MGMT interface?

[Mike.Cifelli]

Good thought, thanks.  So we do have a rather large /16 prefix that encompasses ISE as a static route using the service-port (MGMT access).  I literally just realized that you can only add static routes that use service port gateway otherwise the WLC complains.  The thinking now is to to make more specific routes for MGMT purposes, delete the /16, and enable per-WLAN radius support to see if this aides in solving the NAS IP mismatch issue.

[Mike.Cifelli]

So enabling the radius server overwrite interface with the WLAN setting did not resolve our issue.  However, using the AP group does fix the CoA issue.  The kicker is if you use this configuration you must add each respective vlan data WLC interface IP as an additional IP in the NAD defined in ISE otherwise users will not be able to onboard successfully.  So for example, vlan 20 WLC data IP is 2.2.2.2, then 2.2.2.2 must be added in ISE with radius enabled to support CoA.  IMO this is sufficient, but TAC is trying to determine if there is a bug.

[Mike.Cifelli]

FYSA per TAC ISE & WLC service port should not be in the same subnet.  When they are the radius packets from WLC are going to be sourced via service port & use this interface.  They sent the following bugs:

Bug Search (cisco.com)

Bug Search (cisco.com)

The suggested fix is either the workaround I mentioned above, or re-IP ISE or the WLC service port.

[Scott Fella]

Mike,

The service port is suppose to be only for OOB and since the early AireOS day's, the guides always stated not to have that connected to the network in which there is connectivity to the management.  There has been more issues with this design, so just be aware.  In all my deployments, I have never connected up the service port, except for in a lab environment and that port was isolated.