Cisco C9800 wlc AP C9105AXI-A Radius auth issue

[hadi123]

Hi, I'm having an issue with the C9800 controller and AP C9105AXI-A. We have two sites, each with a WLC. We tested the failover when the AP switches from the secondary WLC, but the RADIUS authentication for the WLAN is not able to authenticate users.

[balaji.bandi]

what is the logs show, have you added both WLC Controller to NAD in the ISE  or radius ?

[hadi123]

Yes, i have added it to the radius, it is pingable from devices such as wlc and Access point.

[balaji.bandi]

i mean to say did you added both WLC IP address and Virtual IP to Radius ?

Since you are testing, Failback to Active unit and compare the configuration, make sure both the devices have License correct.

what is the Logs or Errors you see on WLC and Radius Server ?

is this Physical or virtual - and what code running : (reference deployment guide - i am sure you come across this)

https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/9800/17-1/deployment-guide/c9800-ha-sso-deployment-guide-rel-17-1.pdf

[hadi123]

Okay, will check on this. Thanks.

[Rich R · Accepted solution]

Are you sure you added the correct WLC IP address?
Did you define the source IP address for radius to use or if not what interface is the WLC using to reach the radius?
It might not be using the IP address you think it is.
You could also do a packet capture to confirm.
Also have you taken account of the CoA which is on a different UDP port - have you added the radius IP to "aaa server radius dynamic-author"?

Also just because ping is working doesn't mean you have allowed the radius and CoA packets in your ACLs and firewalls - have you checked those?

[Mark Elsen]

            >...but the RADIUS authentication for the WLAN is not able to authenticate users.
  - What happens then ? Can you also check the logs of the radius server and see if there are any authenticating attempts ?

   Also validate the configuration on both WLC's (primary and secondary) by using the CLI command
   show tech wireless (not simple 'show tech') and feed the output from that into Wireless Config Analyzer

  M.

[hadi123]

Okay, noted on this. Thanks.

[Flavio Miranda · Accepted solution]

@hadi123 

 Are your WLCs in HA SSO or they are standalone WLC in N + 1?

 If you are facing radius issue probably you have N +1. Make sure both WLC is added to the Radius server. Connect one AP to the secondary WLC and make sure you can make it work after failover tests.

[hadi123]

Yes, N + 1 is our set up.

Will do your recommendation, will get back to you as soon as I get the results.

Thanks.

[Haydn Andrews · Accepted solution]

Login to the RADIUS server

Pull the logs for the client trying to authenticate, it generally will tell you the failure reason. Post it here.

You can also use this test command from the WLC CLI
test aaa group tacacs+ <Username> <password> new-code