Issue with Guest users - [400] BAD REQUEST

[ciscokapajoeen]

We are using c9800 in foreign and anchor setup with guest authorised by Cisco ISE.

As of yesterday, users have hard time connecting to guest ssid. they receive various errors

- impossible to connect to the SSID

-  [400] BAD REQUEST

- even some do not show any thing

The strange thing is that, I do not see anything one the ISE og

[Rasika Nayanajith]

The best way to troubleshoot is to get RadioAcitve Traces for a given client MAC address

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html 

HTH

Rasika

[ajc]

I was testing Guest SSID yesterday and I got the exact 400 BAD REQUEST message and I immediately realized that the WLC URL Redirect was not using the correct URL from the ISE Guest Portal. Once I copied the URL from the ISE Guest Portal into the WLC config, everything worked immediately. Are you using CWA or LWA?. Are you F5 LB your ISE PSN's?. You would not see any ISE hit if there is wrong DNS resolution for the URL redirect for whatever CWA or LWA. 

[gnguyen89]

I'm seeing the following when users try to connect to the portal.  I know where the url is on the ISE Guest Portal but where would it go in the WLC Config?

[romervalera]

I have the same problem, but i have two Service Nodes

If i remove the second node from the WLC configuration it works!

I need this redundancy for high avalibility reason, is there any way to fix it?

[ajc]

Hi Romer, From my previous reply, I was using LWA for Guest SSID Authentication which is not sessionized. That's why it worked even with my F5 LB in place for multiple PSN's. I moved to CWA and now I am facing the same issue as you. Only 1 PSN/Radius entry in the WLC for authentication is allowed otherwise you will get the 400 error because your 2nd authentication request for CWA is hitting another PSN where the session ID does not exist. I am checking the F5 ISE configuration document with Load Balancer F5 in place to see if I can make it work CWA. I will keep you informed.

[gnguyen89]

Also I am doing the same thing going through the f5 to load balance the guest portal page.  It works but sometimes 400 bad request pops up. 

[ajc]

you are probably facing the following issue. I have not implemented source NAT for CWA/CoA so a temporary solution is to point the GUEST SSID to an specific PSN IP with a forwarding traffic F5 rule configured so the F5 1812/1813/8443 rules do not intervene in the Guest SSID authentication process at all. F5 acts like a default gateway only for Guest authentication traffic. Keep in mind that if you are using external DNS like google or similar for the Guest SSID DHCP IP subnet then you need to advertise your private ISE PSN nodes fqdn names/private IP's to external DNS.

https://community.cisco.com/t5/security-knowledge-base/how-to-cisco-amp-f5-deployment-guide-ise-load-balancing-using/ta-p/3631159

[gnguyen89]

This is how it's currently setup it was working for while without any issues.  Then all of sudden it still works but users getting 400 errors.  On the wlc I only listed one PSN.  When users connect they are sent to the external f5 VIP in the dmz.  On the firewall I'm only currently allowing f5 VIP talk to one PSN which is the one listed on the WLC for the radius authentication.  Also on the firewall I'm only allowing the guest network to talk to the f5 VIP on port 8443 only do I need 1812 and 1813?  From the dmz f5 VIP talking to only one PSN is port 8443 also.  

[ajc]

what is the default gateway of your ISE PSN? it should be the F5 internal interface/IP on the same subnet like the ISE PSN so the traffic goes:   internet --- outside int FW ---- dmz / external F5 interface ----internal F5 interface --- ISE PSN and then returned back the same way. Have you had any recent upgrades on your version? i found that 2.7 version was stable and now some stuff working on that version is now broken on ISE 3.3. Forget 1812/1813 by now.

What is your URL in the WLC guest SSID interface for CWA? btw, are you using CWA? if it so, have you checked port 1700 for CoA? 

[gnguyen89]

I have it configured like this from remote site to f5 like you said (internet --- outside int FW ---- dmz / external F5 interface ----internal F5 interface --- ISE PSN), but I do not have the PSN pointed to the f5 as the default gateway.  We are currently running 3.1 patch 6,9 on the ISE.  I am using CWA with the pre and post acl on the wlc.  

The following is what is generated in the Authorization Profile 

cisco-av-pair = url-redirect=https://company.x.com:port/portal/gateway?sessionId=SessionIdValue&portal=(edited out some inforation) &daysToExpiry=value&action=cwa

[romervalera]

ok, if you find something let me know. I'll be very greatful

[Arshad Safrulla]

Are you using CWA or LWA, also share the Web Auth redirect ACL, remember for the redirection ACL deny action is deny redirection (not deny traffic), and permit action as permit redirection.

Also share the IOS-XE code and the AP models.

[romervalera]

Hello Arshadsaf , sorry for the delay. Our ACL is correct, i followed de recommended steps. All the APs are LWA and we have ultiple models, i have two controllers too with differents version (both are listed in the compatibility matrix)  8.5.161.11 (AIR-CT3504-K9) and 8.5.161.0 (AIR-CT5508-K9).

The APs:

AIR-AP1815I-A-K9

AIR-AP1832I-A-K9

AIR-CAP1702I-A-K9

AIR-CAP2602E-A-K9

AIR-AP1852I-A-K9

AIR-AP1542I-A-K9

AIR-CAP1532E-A-K9

AIR-AP1542I-A-K9

All of then are in the compatibility matrix too, and have the irregular behavior.