Cisco AP's 3502I thru 3802I - Lose ability to access non secure sites

[douglas.mckee]

Good Afternoon,

We have 3502I, 3702I and 3802i AP's. We have an issue with some of them only being able to access "secure sites" but once they are reloaded can access both "secure" and non-secure sites. Not sure how long it takes before they revert back to only accessing "secure sites" since this location is used primarily a few times a month. Below is the configuration we use for all the AP ports within our network.

switchport access vlan ###
switchport mode access
switchport block unicast
switchport voice vlan ###
authentication event fail action next-method
authentication event server dead action reinitialize vlan ###
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
auto qos trust
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
service-policy output AutoQos-4.0-Output-Policy
ip dhcp snooping limit rate 100

Thank you,

Doug

[ammahend]

This only tells how you are authenticating the port, once the port is authenticated what authorization policy is pushed to the port will determine what’s accessible through the port.  Do you know what authorization you have set for the port ? 

[Rich R]

What controller?

What software version?

How is the WLAN configured?

Presume when you say "Cisco AP's 3502I thru 3802I - Lose ability to access non secure sites" you mean users connected to those APs?

[douglas.mckee]

Good Afternoon,

Our ISE server wasn't placing our 3802I AP into the proper VLAN. Also, found the GIG interface between the 9500-16X and our 5508 was defaulting to 100MB on auto negotiate. Went ahead and hard coded the correct VLAN and Speed. More than likely the port just wasn't profiling correctly but will let you know if this doesn't fix the issues. 

What controller? 5508

What software version? 8.5.161

How is the WLAN configured? We have only one 5508 WLC connected to our 9500-16X.

Presume when you say "Cisco AP's 3502I thru 3802I - Lose ability to access non secure sites" you mean users connected to those APs? Correct.

Thank you,

Doug