Guest CWA web authenticaion issue with ISE and 9800 WLC

[00u14etpsdAS9rRiP5d7]

Hi,

We are facing issues in guest cwa web authentication as guest user needs to authenticate twice for getting access to guest wifi network.We have 9800 WLCs in 16.12.4a flash version with foreign - anchor setup for guest user vlan.As per ISE logs and user experience he is successfully passing authentication in first instance and when try to browse internet the login page is redirected and when he puts the credentials in second time he is successfully connected to internet.so user is able to access the guest network after entering the credentials twice eventhough first attempt is successful....

For testing we tried the setup by using a guest user vlan on the foreign side and run the test without the foreign anchor setup for guest vlan..In that scenario the guest authentication works fine and only one time login is required.

Please suggest on the same.

[Grendizer]

The Anchor WLC doesn’t need to know about ISE (RADIUS) and actually, there is no communication between the Anchor and ISE (RADIUS) but will need to have the same ACL on both Foreign and Anchor, So, remove ISE config from the Anchor.

[00u14etpsdAS9rRiP5d7]

Hi,

Thanks for your reply.We tried disabling radius accouting from policy sets on anchor wlc still the issue remains the same.What else needs to be removed.please suggest..

[Grendizer]

It’s not just accounting, you don’t need to configure the Anchor with ISE RADIUS at all, if that’s needed for some reason for other SSIDs then you can remove related config from the CWA WLAN.

[00u14etpsdAS9rRiP5d7]

Hi,

We tried removing the ISE(radius) configuration from anchor but still the issue remains the same.Client needs to authenticate twice in guest portal for getting connected to guest network using CWA.

[Grendizer]

Then something wrong with WLC or ISE config, check this doc https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216500-catalyst-9800-central-web-authenticati.html