Clients losing connectivity to guest wireless network

[igor.hamzic81]

Hello all,

I have an issue where wireless users that are connecting to the guest wireless network by entering their credentials through the guest portal are losing connectivity at random intervals(usually within 1 minute of connecting).

From the user side it looks fine the 1st time they enter their credentials in the portal but at a random time the machine loses connectivity and to restore it usually user needs to re-enter their credentials but the problem persists and they have to re-enter their credentails again. This behaviour continues in a loop and effectively the user cannot work on the network.

On the event log on the WLC I see the following events on the client event log(in attachment).

Info on the devices:
WLC 3504, version 8.10.190.0
APs - mostly 2702 APs with several 1832 and 1702 APs
For RADIUS we use Cisco ISE, version 3.2.0.542, patch 5

[marce1000]

  - Start by upgrading to 8.10.196.0 , the last release for this model , and check if that can help,

 M.

[igor.hamzic81]

I will try it as soon as I get the image for the WLC.

[Simon Blomqvist]

I'm assuming you're doing CWA with ISE, correct? How are the guest authorization rules set up? 

[igor.hamzic81]

Correct. We are using CWA. The policy is in attachment.

[Simon Blomqvist]

Okey, nothing wrong there with the authorization rules. How does the authorization profile WirelessGuest look? 

[igor.hamzic81]

The profile pics are attached.

[Simon Blomqvist]

But those are the authorization profiles you've named WirelessGuestCWA_ISE1 and 2. How does the authorization profile that is named WirelessGuest look?

[igor.hamzic81]

Here is authorization profile WirelessGuest in the attach.

The access list that is referenced on the profile contains standard access to the internet via the usual ports/protocols.

[MHM Cisco World]

The client is roaming or not?

MHM

[igor.hamzic81]

Client is not roaming.

[MHM Cisco World]

Then disable sleep mode or adjust the idle timeout 

MHM 

[igor.hamzic81]

Idle timeout is already set to 30 minutes.

[Derrick Hurley]

What does the ISE live log look like for one of the authentications?

[igor.hamzic81]

Here are the pictures of the detailed view from the live log for one authorization. All authorizations look the same in the logs.