AP 2600 doesn´t work properly with ISE

[sola.fernando]

Hi everybody!

I have this issue: When I can connect an endpoint to an AP 3800 via 802.1X through ISE without any problem. That works fine.

Then when the user moves to another location, and his notebook connects to another AP (2600 for example) the endpoint keeps his IP configuration but lose his connection with the rest of the LAN. It remains connected, but it can’t reach even his gateway.

This happen everytime that this happen. We think that it could be the 2600 family but we are not really sure about it.... Any suggest? 

Thanks!!

[Jason Kunst]

Would recommend working with the wireless team as ise doesn’t communicate to the AP directly. The AP communicates to the wireless controller. Might be something to do with fast user roaming caching of the session. I am going to move this

[sola.fernando]

Ok perfect thanks!. Do you move the case? Or I have to do it?

[Sathiyanarayanan Ravindran]

Hi Fernando,

Can you check whether the below recommended configuration is present on ur devices? 

https://community.cisco.com/t5/security-documents/top-six-important-cisco-wlc-settings-for-ise-integration/ta-p/3643795

[sola.fernando]

Additional Information:

The WLC has the entry for the PC/Notebook associate to the AP but if you enter to the AP CLI, it doesn't have the Endpoint MAC Address

[patoberli]

Sounds like your DHCP Lease Timeout is to long. Reduce that to a time, that is lower as the time required for the client to move between the two buildings.
Alternatively you would have to use L3 roaming on the WLC or use different SSIDs between the buildings (if they don't use the same IP networks/vlans).