Guest CWA in SDA-Wireless with C9800 - Redirect ACL Failure in logs

[merilcerpos]

hello everyone,

we are facing a problem with SDA Wireless C9800. We are having besides two 802.1x EAP-TLS SSIDs for internal endpoints a third WLAN SSID with Guest CWA. The redirect ACL is not in the ISE Authorization Policy is configured on the WLC with the same name. When we start radioactive trace for the client we get following error mesage: SANET_AUTHZ_FAILURE - Redirect ACL Failure

It seems the behavior for SSIDs in fabric mode are different to the ones in Central Switching or FlexConnect Mode?

Is there something special to consider for fabric mode Guest SSID?

Do i need to add the Redirect ACL to the FlexConnect Default Profile?

If so, to the default one? how do the other 802.1x WLAN SSIDs with EAP-TLS react to the policy ACL setting then, since all the three WLAN SSIDs will use the same setting.

If not the default one, then how?

Is there any documentation for this for CWA fabric mode WLAN SSID?? I didn't find anything regarding this.

only this here but it says flexconnect only:

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html#anc23

[Rich R]

The documentation seems to lack any detail on this.  Check your deployment against https://www.cisco.com/c/dam/en/us/td/docs/Website/enterprise/sda_compatibility_matrix/index.html and if still not working then suggest to open a TAC case for assistance.

I've never used fabric mode myself so can't comment from personal experience.