Fortinac and WLC 9800 controller

[terrance-mccallum]

New network tech here, just implemented a NAC system along with a WLC9800 model. My NAC system put all unknown devices into a quarantine VLAN for example VLan 100 they go through a portal page and register as either guest or a domain user which will get either a guest or domain vlan address. Portal page works perfect and registration goes fine. The issue im seeing is either after registration the client sits for almost 30 minutes before It changes the client to the correct VLAN or I can manually go in the WLC and delete that client and it will instantly get the address that it should based off the registration. Any idea where to start this troubleshooting, with the old WLC things seem to switch over pretty quickly but having issue since new one was implemented. Any ideas where to start to investigate this???

[MHM Cisco World]

NAC return CoA re-auth or port bounce ?

since vlan is change you need to port bounce 

MHM

[terrance-mccallum]

I don't think there is no port bounce config, I do see a COA server key in the WLC but im not quite sure it's working. Is there a method to test this manually to see if this is working?

[MHM Cisco World]

I send you PM

MHM

[marce1000]

  @MHM Cisco World   wrote :                             >I send you PM
                                                 - What's wrong with sharing knowledge in the community ?

 M.

[Rich R]

Agreed with @marce1000 - the whole point of Cisco Community is to share knowledge not keep it secret!

[Flavio Miranda]

@terrance-mccallum 

 You probably have the features "support for CoA" and "AAA overide" enable, right?

[terrance-mccallum]

Correct, and I also can run the " show aaa server detail " command and see my radius server list and shows enabled. however I am not seeing any vlan change when made in the NAC system, unless I delete the client from the WLC completely it will then come back with the assigned VLAN, If not mistaken in old WLC the NAC would do this step automatically when a change was made, however now it is not.

[Flavio Miranda]

On the link below, Cisco show how to implement a similar setup using ISE but I believe you can check the WLC part which should be the same.

At the end of this document, they show how you can get a Radioactive Trace that can be helpfull for you. You can share the logs here, if possible.

It is possible to enable the Radioactive traces to ensure successful transfer of the RADIUS attributes to the WLC. In order to do so, do these steps:

1. From the controller GUI, navigate to Troubleshooting > Radioactive Trace > +Add.
2. Enter the Mac Address of the wireless client.
3. Select Start.
4. Connect the client with the WLAN.
5. Navigate to Stop > Generate > Choose 10 minutes > Apply to Device > Select the trace file to download the log.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html

[terrance-mccallum]

attached

[Flavio Miranda]

Seems like the radius communication is fine

2024/12/13 10:15:31.287576879 {wncd_x_R0-5}{1}: [aaa-attr-inf] [24831]: (info): [ Applied attribute : tunnel-type 0 13 [vlan] ]
2024/12/13 10:15:31.287578693 {wncd_x_R0-5}{1}: [aaa-attr-inf] [24831]: (info): [ Applied attribute : tunnel-medium-type 0 6 [ALL_802] ]
2024/12/13 10:15:31.287580124 {wncd_x_R0-5}{1}: [aaa-attr-inf] [24831]: (info): [ Applied attribute :tunnel-private-group-id 0 "48" ]
2024/12/13 10:15:31.287581563 {wncd_x_R0-5}{1}: [aaa-attr-inf] [24831]: (info): [ Applied attribute : username 0 "e40d366921f7" ]
2024/12/13 10:15:31.287587016 {wncd_x_R0-5}{1}: [aaa-attr-inf] [24831]: (info): [ Applied attribute : timeout 0 28800 (0x7080) ]

Did you took the action of remove the client?

2024/12/13 10:19:02.121

client-orch-sm

Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_ADMIN_RESET. Explanation: Administrator removed the client, or in some scenarios, AAA server requested client delete. Actions: None required

If you did, can you take the debug but not interfere to compare?

[terrance-mccallum]

No, I feel like that's the issue it's not doing that step, but if i manually go and delete it, it will then get the correct address and everything works fine. I dont' know why its' not doing the delete even though it's being told to do so.

[terrance-mccallum]

To add to that, If i let this device sit for a long time up to like 20 minutes it will eventually go through almost like it fails out and at some points tries again and works at that point.

[Flavio Miranda]

this seems to be some kind of time out.  30 minutes is 1800 seconds which seems to be the session time out for your WLC 

[Flavio Miranda]

Try to reduce the Session time out  and see if that makes difference