Hello all,
I have multiple regional locations w/ 5520 WLCs. These WLCs are connected to a Nexus 9k (Services) -> Catalyst 9k (CORE) -> Router. The associated APs are connected to access switches -> CORE -> Router. I have a Guest Wireless SSID set up w/ an anchor WLC in the DMZ. Without any ISE involvement, I confirmed successul access to the internet through the DMZ.
However, I am experiencing the following error during the Guest Flow - where users create their Guest account and sign-on:
11213 : No response received from Network Access Device after sending a Dynamic Authorization request - DYNAMIC AUTHORIZATION FAILING
From the Guest perspective, they connect to the SSID -> redirect successfully to ISE Sponsor Portal -> Create account -> Accept AUP -> Click "sign-on"............. afterwards, they are unable to connect to the internet.
ISE is showing the above error and as a result not placing them in the correct policy. I have been working w/ TAC on this issue for ~2 months to no avail. We have confirmed ISE is sending the CoA but receiving nothing back. I have confirmed the following:
-Confirmed shared secret on AAA server on WLC
-Confirmed CoA Support setting enabled on WLC
-Most up-to-date iOS version
-Guest SSID settings are correct - including mac filtering, ISE Default settings, AAA override, ISE NAC, etc.
-No firewall blocks in between ISE and WLC blocking traffic (CoA - port 1700)
Any advise would be appreciate. I am lost on where to go from here.
