Windows 10 and Android device authen fail with Web auth WLC9800

[donamthe]

Hi all, I'm implementing a Web Auth for a guest SSID. I use local guest user for authentication. Iphone devices are logged in successfully. However, some Android devices and some Windows laptop cannot log in. It says Authentication failed.
Could you please advise what I should check to fix this issue?
Thank you.

[marce1000]

 - Debug the particular clients according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA

      Also have a checkup of the WLC9800 configuration with the CLI command show tech wireless ; feed the output into
                              https://cway.cisco.com/wireless-config-analyzer/

 M.

[donamthe]

Thanks for your advice. However after checking, I see no abnormal configuration. Some devices can authen successfully. Just some cannot. Could you please give me some further advice?

[Rich R]

- What version of IOS-XE are you using? Refer to TAC recommended releases (link below)
- Have you run and analysed Radioactive Trace on one of the failing clients?

[donamthe]

Hi Rich, please see the information below:

- What version of IOS-XE are you using? Refer to TAC recommended releases (link below)

-> I'm using 17.3.6

- Have you run and analysed Radioactive Trace on one of the failing clients?
-> Could you please instruct me how to do this?

[Rich R]

17.3 is already end of software maintenance and end of security updates = no more bug fixes and no more security fixes, so you really need to update to a fully supported release.  Refer to the TAC recommended releases link below but TAC currently recommend 17.9.4.
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-3-x-eol.html
17.3 had a LOT of bugs and the remaining bugs will not get fixed in 17.3 now.

Refer to the config guides for radioactive trace.  You need the MAC address of the client which you want to debug (remember that might not be the device hardware address if they're using private (random) MAC address.
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_debug_ra_ewlc.html