Cisco WLC 9800-L-F and Cisco suggested release images 17.12.3 & 17.9.5

[girish_gavandi]

Hello,

So, I was migrating very old wireless network devices (WLC 5508 and Ap 3602I) at a customer site. Customer purchased WLC 9800-L-F and C9136I-ROW AP. We decided to use 17.12.3 as the WLC software. The software being marked as Cisco suggested releases.

Further reference: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html

Wireless network deployment at customer site is vanilla CWA deployment. Configured as per CWA Tech Notes.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html

There are 3 SSIDs (GUEST, VIP and EVENTS) configured for similar functionality but different access levels and privileges. All SSIDs are mapped to the same SVI interface. ISE authorization policy is defined based on called-station-id of the WLAN. All 3 SSIDs have similar config on WLC. However, upon testing it was found that all Android and iOS clients would not connect to GUEST SSID and could easily connect to VIP and EVENTS SSID. Mobile phone clients wifi page would show "connection failed" and it would not associate with the AP. But the other 2 SSIDs would have all clients connect to it as expected. No delays, no issues.

2 days of tshoot time was spent on it by my team and later 3 days with Cisco TAC. Tested every bit of configuration on WLC and ISE. In the end downgraded the WLC to next Cisco suggested release 17.9.5. Hoping this would fix any problems related to the new software. It was found that all iOS clients were connecting without any issues with GUEST SSID. Android clients still had same "connection failed" issue.

Collected more logs for the case notes and Cisco TAC is investigation the issue along with BU. It is very strange that 2 of the Cisco suggested software releases dont function even for basic CWA configuration.

It would be interesting to know the root cause. Anxiously waiting for TAC response. I shall post the update once available.

Meanwhile, if anyone has faced similar issues with 17.12.x or 17.9.x versions, please feel free to post their experience.

Regards,

Girish

[ssaluga]

Hi All,

I wanted to post an update as my issue has been resolved and I hope that someone in the future may find this information useful.  Our issue ended up being the TCP MSS Adjust size setting for the access points.  This setting is available per AP or AP Globally.  Apparently, Android is sending some packets that exceed the default setting in the 5520 configuration for the access points (9130s, 9120s & 3702s) in our case.  Setting the TCP MSS Adjust size to 1250 (default for the 9800) solved our issue.  Android clients now behave as expected.

[Leo Laohoo]

That's beginning to sound like CSCwm37410.

[Rich R]

This is covered in the Best Practices guide https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#EnableTCPMSSacrossallAPs so somebody must have decided to change it away from the default 1250.  The lesson is that if you're going to move away from best practice you'd better know what you're doing and what impact it will have <wink>