Roaming issue when moving to another areas (WLC + ISE)

[Xibachao1]

Hi experts,

Our system deploy SSID with WLC C9800 and ISE.

We are having a problem. Please give me some advice.

We have 5 separate zones. Different group IPs but same VLAN.

Some users can use Wifi normally but when they move to another zone (roaming), their laptops cannot access WiFi (SSID broadcast in whole areas). ISE logs only show "Posture Unknown" status and their laptops show "Connected to Wifi" but the connection is limited or not available in Cisco AnyConnect application. It means the AnyConnect does not trigger scan the laptop.

[aaronO]

Hello,

Few questions:

• I am not sure what do you mean with you have 5 different zones? => is that reflected somehow on the WLC configuration? 
• Are you saying that you have a VLAN that accommodates different subnets?

I think it would be useful to provide more information about the SSID settings as well as what you are trying to accomplish. 

Saludos, Aaron 

[Xibachao1]

Hi @aaronO ,

Kindly of 5 campus. Each campus has a L3 distribute to switch core. User facing with issue when moving from campus 1 to campus 2.

[MHM Cisco World · Accepted solution]

Sure that face issue' 

Same vlan different subnet and l2 roaming' you need to force roaming to do l3 not l2

This make client ask IP and hence reachable in site it roaming TO.

MHM

[aaronO]

There quite some things that you need to consider if a client moves from one campus to another. You need to provide more detail about the configuration / set up so we can help. 

• what type of authentication?
• is this a local / flex / anchor SSID? 
• is client doing L2 or L3 roaming? 
• is client moving between AP same model?

Maybe sharing the parts of configuration that are related to the problem is helpful too. 

[vkokila]

In addition to the above mentioned info: 

After the roaming event, start checking the below:

- If the wireless client has a valid ip on the expected vlan? 
- If the client is in RUN state?
- Correct ACL's applied to the client on WLC?
- If the client is able to reach its gateway ?

Compare these details with a working client after roam to a non-working client after roam.