cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1406
Views
20
Helpful
8
Replies

Authentication passed but no session?

Mottok
Level 1
Level 1

Hi, can anyone suggest the possible reasons why Cisco ISE would authenticate an end user device with "5200 Authentication succeeded" but there is no active session? I've seen this several times for some users who are having trouble connecting. Am a noob so even obvious suggestions welcome! Many thanks

8 Replies 8

marce1000
VIP
VIP

 

 - What's your ISE version and include same info's for the current wireless platform(s) being used , also provide controller-model (e.g.)

 M.



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Hi, sorry thought it would be a generic issue/question so didn't include.

 

ISE v2.4

Cisco WLC 5520 8.3.133.0

Cisco network from end to end including AP's 

 

Many thanks

 

                        Ref : https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/compatibility/b_ise_sdt_24.html

 Looking at Table 4. , all ISE features are supported from 8.5x.  , in 8.3x Guest Originating URL is not supported , don't know if that is related. You may try an 8.5.x release and compare.

 M.



-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Many thanks for your reply. That's an interesting point but would a session not be initiated on ISE even though the user's browser didn't go to the previous web page?

 

The other thing is I am also getting these issues with our internal non Guest SSID users. Attached is an example of a user that has just authenticated and a session icon is showing under "Live Logs" but no session shows under "Live sessions"? I don't get it.

 

Thanks.

Just want to better understand the issue.  Is it with guest or like employees using 802.1x?  I only really focus on the live logs and not live session.  Live logs to me, show me the information I need.  Also when you have issues, putting in as much detail as possible helps.  Generic questions will not get folks to chime in.  One thing you should mention, is "what the issue is" and "are you able to replicate it or not".  Things like, is the client in the run state on the controller, is your design using local mode of flexconnect, is the issue with certain devices or types of devices or maybe with just a single ssid.  All this helps folks think and provide a response or maybe even ask more questions. 

-Scott
*** Please rate helpful posts ***

Hi, appreciate your reply. This is happening for both Guest and employees using 802.1x. I realise I should have more info here but I'm so new to this I don't even know the answers to each of the questions you suggested.

 

I just thought that there maybe a couple of generic suggestions as to why a client who says they can't establish a Wi-Fi connection still gets both an "authentication success" and a "Session" in Live logs but not in Live sessions. Maybe being a bit naive.

 

Thanks

You probably need to start with a debug of a client experiencing the problem on the WLC to see precise detail of what's happening when it goes wrong.

https://cway.cisco.com/wireless-debug-analyzer/ can help with understanding the debugs but sometimes the reason should be obvious once you look at the debugs - sometimes can be as simple as you forgot to enable fast SSID change https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/b_cg83_chapter_0100001.html and therefore client gets deleted after switching SSID.

Also 8.3 AireOS is end of life and 8.3.133.0 release is not the latest - see https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc10 so you might be hitting a known bug which was fixed in a later release.

Seriously consider moving to 8.5 or later AireOS if your APs are supported - see https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html#pgfId-590411

 

Many thanks for this and to everyone. I am going to look in to upgrading and then re-visit the issue as I could be chasing my tail. Makes sense even if we didn't have these questions.

 

Thanks again and if I find anything useful, will post here.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: