Konstantin I was also initially use ISE to send a Radius override with a session timeout value. I did this with different values for different authorization policies. I think this somehow meant ISE was controlling the session, not the WLC. So when the iPad dropped WiFi during sleep, the controller lost it's state, and ISE terminated the session. To resolve it, I remove the Reauthentication timer from ISE and let the controller provide the session timeout value. Now, when the iPad goes to sleep, it still drops WiFi, but the session state is maintained in the WLC, the iPad just reauths successfully with ISE. So the user doesn't have to hit the web-auth page again upon waking the device, WiFi is just up and connected.
On a side note, I found out that the iPad sends wireless beacons out every 10 minutes. So essentially, it reauthenticates with ISE every 10 minutes. I have not hit my idle timeoute value yet, but I'm afraid that because of this 10 minute beacon, even a sleeping iPad will not be idle long enough to be disassociated.
