Cisco 9800 Foreign and Cisco 5520 Anchor CWA Guest SSID

[Chris Terry]

I'm trying to configure a guest SSID on the Cisco 9800 with a 5520 as the anchor controller. The SSID has a CWA portal hosted on the external ISE appliance. Normally the flow (which is still working on the existing 5520 foreign controllers) is that you connect to the SSID and hit a CWA portal to enter your credentials. The issue I'm having with the 9800 is that the clients are bypassing the CWA.  The ACL should be blocking everything except traffic to/from the portal and DHCP/DNS traffic.

The client is in a RUN state on the foreign, but on the anchor is shows CENTRAL_WEB_AUTH. On the 9800 for the client details I see nothing under the Client ACL, but I do see the ACL and redirect URL under Server Policies and Resultant Policies. On the anchor I see the redirect URL and Pre-Auth ACL

Cisco 9800-40 version 17.09.05.0.6450 (foreign WLC)
Cisco 5520 version 8.10.190.0 (anchor WLC)

[balaji.bandi]

may be debugging should help here. but check configuration again as per below document :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216500-catalyst-9800-central-web-authenticati.html#toc-hId-264302890

[marce1000]

 - You can debug CWA on the 9800 using https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA
   Also  have a checkup of the 9800 foreign controller  configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

     - You may do the same on the 5520 using WirelessAnalyzer input (procedure) for AireOs controllers
        and feed the output from that into Wireless Config Analyzer  too

  M.
    

[Chris Terry]

I can see the ACL being applied under the client details.

I know the CWA ACL has to be reversed on the 9800 compared to the 5520. Is that the same case if the anchor is a 5520? Does it need to match exactly what the CWA ACL is for the 9800, or does it stay the same? We have two other pairs of 5520s as foreign WLCs in our environment that use that 5520 anchor using the same CWA ACL.

I.E. (Not the full ACL)
ACL: 9800 foreign - Deny traffic to ISE server | 5520 anchor - Allow traffic to ISE Server
or would it be
ACL: 9800 foreign - Deny traffic to ISE server | 5520 anchor - Deny traffic to ISE server

For the current 5520 foreign controllers:
ACL: 5520 foreign - Permit traffic to ISE server | 5520 anchor - Permit traffic to ISE server

I can post the full ACL if needed