Intermittent 802.1X Authentication Drops on WLC 4400

[CISCOTUMBA]

Hi all,

We've recently implemented 802.1X authentication on our Cisco WLC 4400 Series, and we're experiencing intermittent connection drops on some computers—but not all. We've double-checked the WLC configuration and conducted a wireless site survey using a Sidekick device, and everything appears to be in order.

Currently, we're broadcasting four different SSIDs. The issue only occurs on the SSID using 802.1X authentication; the other SSIDs are stable with no connectivity problems. This suggests that the issue is isolated to 802.1X.

We’ve also reviewed the RADIUS server logs. All authentication requests are coming through successfully, including the accounting information. The NAS identifier correctly shows the WLC IP.

Has anyone else experienced a similar issue with 802.1X on this model, or is there anything else we should be checking?

Any help or guidance would be greatly appreciated.

[Mark Elsen · Accepted solution]

  - @CISCOTUMBA       Bare in mind that this controller is very old and beyond support and software downloads for a long time.
                                     If the problem is due to bugs, then there is no hope for resolving this.
                                                    Migrate to the modern 9800 controller  platform(s)

  M.

[Saikat Nandy · Accepted solution]

Although this is not the right approach but some general guidelines where issues can be - look out for idle timeout, session timeout and advanced EAP timers..apart from that you can take debug client <client mac> reproducing the issue and see where the issue is. Anyway as @Mark Elsen said, you are living in ancient time. It's high time to do network refresh.

[CISCOTUMBA]

I agree for the network refresh but @Saikat Nandy can you tell me more about the debug part? How can I run a debug on the controller?

[Saikat Nandy]

Command is 'debug client <mac address>'. You can follows these steps - 

1. save the putty session in a notepad file.
2. Run the following commands in the WLC CLI - 
> config session timeout 0
> config paging disable
> debug client <client mac address>
3. The logs will start getting printed in the putty session.
4. Wait for the issue to reproduce. Take a note of the timestamp.
5. Take a look into the debug output and see what is present.

[CISCOTUMBA]

Got it 

I appreciate your help @Saikat Nandy 

[Leo Laohoo]

What firmware is the controller on and what is the authentication server?

[CISCOTUMBA]

Here is the version information:

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.0.98.0
RTOS Version..................................... 7.0.98.0
Bootloader Version............................... 4.0.217.0
Emergency Image Version.......................... 5.2.157.0
Build Type....................................... DATA + WPS

The auth server is clearpass radius.