Hi all, hoping that somebody out there might have seen something similar to what we're currently experiencing?
Basically, we are seeing issues whereby clients are associating to a SSID configured for 802.1x, being authenticated successfully (ISE Policy Set filtering on the WLC) and then allowed connection to the appropriate network as per defined VNID... However, at some point after that authentication, approx 45mins according to support chaps the users report a loss of connectivity and have to connect to the wired network.
This is where it gets interesting, when we look in ISE we can see that the clients wireless MAC address is now hitting authentication policies within a policy set that is filtered on the Switch hostnames and where the MAB request is coming from the switch interface where the AP is configured. This means that we see a load of MACs on the switch port;
After extensive searching I've found a bug CSCwb87363 : Bug Search Tool (cisco.com) which appears to be along similar lines however there's no detail.
We've had a TAC case open for this whereby it was intimated that there was an ISE policy configuration issue, I've guided my support colleagues to go back to TAC with the above bug reference.
The affected users if they physically roam to another AP immediately authenticate and get onboarded as expected, I'm not sure if the problem follows them around as we've not ascertained that.
