client cannot get TCP syn-ack message in CWA using cisco 9800/ISE

[atifali.zaidi1]

i have the below setup in the lab 

foreign and anchor (both 9800) connected to the same L3 switch, mobility tunnel built and is UP (remote site but same country)

the L3 switch connects to the Prisma SDWAN device (WAN)

prisma wan device hosts the Guest subnet L3 / DHCP scope / ISP DNS - 10.x.x.x

cisco ISE in the DC (same country) --------- we are using CWA

redirect ACL present on both the controllers and both added to ISE as mentioned below

10 deny udp any any eq bootpc
20 deny udp any any eq bootps
50 deny ip any host <ISE-IP>
60 deny ip host <ISE-IP> any
90 deny udp host <dns-ip> eq domain any range 0 65535
100 deny udp any range 0 65535 host <dns-ip> eq domain
110 deny tcp host <dns-ip> eq domain any range 0 65535
120 deny tcp any range 0 65535 host <dns-ip> eq domain
170 permit tcp any range 0 65535 any eq www

client connects to the ap , foreign wlc performs MAB via ISE <<<<< success

client gets an IP address via the prisma wan ---- success

client performs dns lookup to captive.apple.com , dns response recieved with the IP address of captive.apple.com ---- success

client initiates TCP syn packet <<<< this packet should be intercepted by anchor wlc and anchor wlc should reply back with a TCP syn ack message , TCP syn packet re-transmissions keep happening and then nothing happens further.  i took pcaps on both foreign and anchor wlc and then i can see that the TCP syn packet which the client sends , the destination is showing as prisma sdwan device, which is fine but then shouldnt the anchor wlc intercept this packet this syn packet and send back syn-ack ?  do i need to configure an additional L3 interface of guest on the anchor wlc ?

please suggest how this could be solved.

[aaronO]

Hello,

Interesting. So you are seeing the TCP SYN message from client on the anchor and the anchor is not reacting to it correct? 

• Do you mind sharing the packet captures and WLC configs?  
• While client is waiting for TCP SYNC Response, what is the status of the client in the anchor and foreign WLC? 

I would try to debug on both controllers to understand why the TCP Is not being answered. 

debug wireless mac aaaa.bbbb.cccc to-file bootflash:debug-client.txt 

• have you tried to enter ISE IP address on client browser? what is the result? 
• have you tried another browser? 

The ACL looks fine to me. Can you confirm ACL is being apply by WLC on client details? 

Cheers, Aaron 

[atifali.zaidi1]

the foreign wlc talks to ISE , ise sends access accept + redirect acl + redirect URL .  the status of client on foreign controller says "run" and on the anchor it says "webauth pending"  and i can also see anchor wlc applying redirect acl and redirect acl , clients does dns lookup to anything and gets a response from the dns server , now the client sends TCP syn packet destined toward its gateway which ideally should be intercepted by anchor controller and it should respond back with a syn ack message but i keep seeing TCP re-transmissions happening .  we opened ports 80,443 and 8443 from Guest client subnet towards ISE .  what seems to be issue ?  sorry i cannot upload pcaps or RA trace.

[Rich R]

Software version @atifali.zaidi1 ?

What about pre-auth ACL?

As @aaronO said you need RA trace of the client ...