Reauthentication with C9800 Web Authentication

[jewfcb001]

Hi All ,

I would like to know behavior of WLC C9800 with Web Authentication . 
Incase If Client connect to SSID: Web_Authen and authentication success and disconnect this ssid and connect SSID Web_Authen again Client need to reauthenticate or not ? Because I try to simulate test client need to new authentication every time. 

Thank you .

[MHM Cisco World]

In wlc monitoring >client 

If the Mac of wifi client is disappear then wlc 9800 totally remove client session and hence when client reconnect it need reauthc

MHM

[jewfcb001]

I observe with android device this device not reauthenticate. 

[MHM Cisco World]

Did you check monitor in wlc 

Can you see mac of wifi client 

MHM

[jewfcb001]

@MHM Cisco World 
cannot see wifi client if client disassociate WLC (IOS Device)
but android client still see mac client after client disassociate WLC

[Rich R]

As I explained above that's a difference in client behaviour.

If you want the returning client to be seamlessly re-authenticated then you need to use MAC auth (MAB) to log them back in without web auth.
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html#toc-hId-1941470559

[Mark Elsen]

    >....I observe with android device this device not reauthenticate. 
         Then 'take a diff' on what both clients do (or not) using  -   https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

    Appendix :    Have a checkup of the 9800 WLC configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer
    (do not use a simple show tech as input for this procedure)
                       + Look at client stats from https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5
                                     (for insights on overall client behavior)

                            Check software version on the controller , go for 17.12.3, if applicable (advised)

 M.

[jewfcb001]

@Mark Elsen 
I try with c9800 version 17.14.01. I would like to know this scenario is nornal behavior or not ?

[Mark Elsen]

        - This is normal , 

 M.

[jewfcb001]

@Mark Elsen 
Thank you for response . But I observe with android device this device not reauthenticate.

Do you have solution for not reauthenticate?

[David Ritter]

nice topic,  I have and EOC guest account where the participants what to link when they arrive and stay linked... rather than reauthenticating every so often.

Since open ssids get full fast, the session timeout is 30 minutes.  So I presume that be the ruling factor.  management wants to know if that 'timeout' is idle time or busy time.

[Rich R]

Depends to some extent on the client's behaviour.  If the client de-authenticates then they are disconnected from WLC and will need to re-authenticate next time they connect.  If the client simply goes to sleep and doesn't de-authenticate then the timers come into play.  Session timeout is absolute. Idle timeout depends on inactivity.  If you want clients to be able to sleep and return without re-authenticating then consider using the Sleeping Client feature.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#SleepingClientfeature
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/config-guide/b_wl_17_12_cg/m_vewlc_central_web_authentication.html#Cisco_Troubleshooting.dita_7e7b09b9-831c-4d6b-b573-d96bd4ba4a70

[jewfcb001]

@Rich R 
I try to enable sleeping Client but the client still re-authenticate . 

[Rich R]

"Sleeping Client" will only work for an actual sleeping client.  As I explained if the client has actually de-authenticated then that is not a sleeping client.  You need to use MAC auth (MAC Authentication Bypass) to re-authenticate a returning client automatically.  Link to example provided in my other reply below.

[jewfcb001]

@Rich R 
as you mean . Web Authenticate not working with sleeping client and need to new authenticate ?