Issue with Guest SSID Users Unable to Access Internet After Reconnect

[rahul-naik]

Hi community,

I have configured a Guest SSID with Local Web Authentication on our 9800 WLC. Initially, users were facing frequent re-login issues. To resolve this, I made the following changes:

• Increased the init-state timeout to 28800 seconds

• Enabled Sleeping Client Status with a timeout of 720 seconds in the Webauth global settings

These changes successfully resolved the frequent re-authentication issue.

However, we are now facing a new issue:

• After the first successful login, users can access the internet as expected.

• But if the user disconnects and reconnects to the same SSID later, their device shows as "Connected," but they are unable to access the internet.

• Additionally, these users do not appear in the WLC client list, even though their devices show as connecte

[marce1000]

(Edited) -  Debug clients when they reconnect with no functional network access  ,using : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity

      (           Or  https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA for initial WebAuth issues)

 M.

[marce1000]

 - You can have client debugs , so called Radio Active Traces analyzed with : https://cway.cisco.com/wireless-debug-analyzer/

 M.

[marce1000]

  -  Always validate your 9800 controller's configuration using the CLI command : show tech wireless
    And feed the output from that into https://cway.cisco.com/wireless-config-analyzer/
                    Do not use a simple show tech-support for this procedure

    + What software version are you using ? 

 M.

[Scott Fella]

Let's go back to the basics..... you need to make sure your idle timer is set lower than your session timer.  Also, your sleeping client needs to be set higher so that a user doesn't have to hit the portal page when they come back from lunch as an example.  I would set that to like 12 hours or 24 hours. Session timer can be 28800 seconds and your idle timer can be set back to default.

Like what @marce1000 mentioned, you would need a debug in case you have to troubleshoot further.