Windows 10 and Android device authen fail with Web auth WLC9800

donamthe · ‎09-21-2023

Hi all, I'm implementing a Web Auth for a guest SSID. I use local guest user for authentication. Iphone devices are logged in successfully. However, some Android devices and some Windows laptop cannot log in. It says Authentication failed.
Could you please advise what I should check to fix this issue?
Thank you.

marce1000 · ‎09-21-2023

- Debug the particular clients according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA

Also have a checkup of the WLC9800 configuration with the CLI command show tech wireless ; feed the output into
https://cway.cisco.com/wireless-config-analyzer/

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

donamthe · ‎09-26-2023

Thanks for your advice. However after checking, I see no abnormal configuration. Some devices can authen successfully. Just some cannot. Could you please give me some further advice?

Rich R · ‎10-05-2023

- What version of IOS-XE are you using? Refer to TAC recommended releases (link below)
- Have you run and analysed Radioactive Trace on one of the failing clients?

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

donamthe · ‎10-05-2023

Hi Rich, please see the information below:

- What version of IOS-XE are you using? Refer to TAC recommended releases (link below)

-> I'm using 17.3.6

- Have you run and analysed Radioactive Trace on one of the failing clients?
-> Could you please instruct me how to do this?

Rich R · ‎10-06-2023

17.3 is already end of software maintenance and end of security updates = no more bug fixes and no more security fixes, so you really need to update to a fully supported release. Refer to the TAC recommended releases link below but TAC currently recommend 17.9.4.
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-3-x-eol.html
17.3 had a LOT of bugs and the remaining bugs will not get fixed in 17.3 now.

Refer to the config guides for radioactive trace. You need the MAC address of the client which you want to debug (remember that might not be the device hardware address if they're using private (random) MAC address.
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_debug_ra_ewlc.html

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390