Wireless client IP acquiring delay

[ppnlr]

we are integrating 9800 with ISE for posture check. we observed that when the client provisioning portal pops out because of the url redirection, the delay for the the wireless client to get production IP increases comparing if the url redirection is not working. 

When url redirection is not working client acquires IP in less than 20 sec whereas when the redirection is working, i takes more than a minute.

Is there a way to make it faster?

[Flavio Miranda]

@ppnlr 

  The delay is bigger when the communication is working because the traffic must go to ISE in oder to ISE reply with the redirect URL and we need to consider the WLC in between acting as a proxy for this traffic.

When the communication is not working and you are not redirected, the traffic is not going to ISE. Would be like if you fallback from CWA to local redirect and on this case clients move to IP address discovery right the way. 

[ppnlr]

Thanks @Flavio Miranda for the input. So the problem is, comparing to an old the WLC using aireos, it can achieve the faster delay with the url redirection working. I mean with aireos, the client device can get IP as fast as when the redirection is not working on the 9800.

[Flavio Miranda]

@ppnlr  Check how guest is configured in both WLC. 

There is Local Web auth usually configured in older WLC and there is Central Web Auth used in newer WLC.

LWA the clients first get an IP address and then it is redirected to the portal (internal on the WLC or external) and then the authentication happens. On this mode, the process of getting IP address is way faster as the client need the IP address in order to call the portal.

And then we have CWA, which uses a Radius server for the authentication. On this mode.  the clients does not receive IP address until it is authenticated, just like it happens in any radius process. The client will receive the portal guest url, will authenticate and after that it will receive the IP address. 

 Which means, in CWA, will take longer for clients get IP adderss. 

[ppnlr]

We are using CWA on both wlc, on the ise side, we are using the same policies for both wlc. on the process of posturing  on the client, the difference is with 9800 takes longer to get the prod vlan IP.

[Flavio Miranda]

You can use debug on WLC and ISE to track where the delay comes. Wireshark also helps on this case. 

Ultimatelly, you can also open a TAC.

[MHM Cisco World]

I will send you PM

MHM

[Rich R]

Why @MHM Cisco World