C9800: AP Behaviour when Disconnected to WLC

[tcp_analysis_flags_eq_1]

Hello, I want to verify something wether this is a normal behaviour

WLC: 9800-CL

AP: C9120

Environment: Flex, Local Switch, Central Auth, ISE Auth

Scenario: Users are already connected to the Wireless, then due to outage on WAN links, the AP losses connectivity to the WLC. For some reason the already authenticated user also got disconnected from wireless. I understand that it should only affect clients that are yet to authenticate? 

I am open to sharing configuration of the flex profiles and wlc but is this the correct behaviour?

[marce1000]

  - Client debugging  according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity may provide more insights as to why this is happening ; you can have client debugs (so called RadioActive Traces) analyzed with : Wireless Debug Analyzer

   - Have a checkup of the WLC 9800 configuration too using the CLI command show tech wireless and feed the output into :
                                                                                                                          Wireless Config Analyzer

   - Check software version being used on the 9800-CL , preferably go for 17.9.4a (latest advisory) + APSP and check if that can bring improvement.

  M.

[marce1000]

 - Added reply ; you may also get additional insights from : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5

 M.

[Rich R]

> Flex, Local Switch, Central Auth, ISE Auth

Users will need to re-auth periodically and on roaming.  Because you are using central auth they will be disconnected.
You also haven't mentioned DHCP - should be local since you're local switching but if central then that's also an issue.

Best to understand flex limitations.
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213921-flexconnect-configuration-with-central-a.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_flex_connect.html#restrictions-for-flexconnect-specific-details

[tcp_analysis_flags_eq_1]

Hello periodically yes, according to the reauth timers and roaming I understand, but this is not the case. Even if an authenticate user does not move/switch APs, the moment the AP loses its CAPWAP connection to WLC, they are all disconnected. DHCP is local as well, but again goes back to client disconnecting and cannot reconnect because they have to reauthenticate and cannot reach the auth servers because WAN is down.

[Rich R]

Agreed that sounds wrong.  Just to confirm:
- Your profile policy has the following?
no central association
no central dhcp
no central switching

Have you tried a debug on the AP to see what it actually says about the WLAN when it goes into standalone mode?  That might actually tell you why it's doing that.  The always-on persistent logs in the AP may already have some of that detail in them - have you checked them?

If debugs and logs don't show anything useful then I'd open a TAC case and see what they say about it.

[tcp_analysis_flags_eq_1]

Yes I have those in policy, below is the policy configuration

 aaa-override
 accounting-list aaa-acco-wifi-id
 no central association
 no central dhcp
 no central switching
 dhcp-tlv-caching
 http-tlv-caching
 idle-timeout 2400
 nac
 radius-profiling
 service-policy input AutoQos-4.0-wlan-GT-SSID-Input-Policy
 service-policy output AutoQos-4.0-wlan-GT-SSID-Output-Policy
 session-timeout 84000
 vlan zxcfdafdasf
 no shutdown

[Rich R]

I can't see any relevant restrictions on NAC but the docs do say: "However, to support 802.1X EAP authentication, FlexConnect access points in standalone mode need to have their own backup RADIUS server to authenticate clients."
You don't have local backup radius do you?  I wonder whether that's the reason the WLAN is dropping when the AP goes into standalone mode.  I would do those debugs and check the logs to confirm either way.  And if it is that - then I also wonder if configuring local backup radius, even if not reachable, would stop the WLAN from going down immediately.

Radius profiling obviously also requires connected mode but that should only apply when client joins.