WLC 5502 Not Sending Message-Authenticator Attribute to ISE

[Vinicius Monteiro]

Hello team, I hope you're well

I have a problem that when I enable the Require Message-Authenticator Attribute in the ISE, the network that uses the guest portal stops working because the ISE drops all connection requests because it does not have the Message Authenticator, however in the other WLCs I do not have this problem, only in this 5502, has anyone experienced this and gotten a workaround? I have already checked the settings between the wlcs in order to find any difference and enable, but I have not identified it

WLC Version 8.3.150.3

[marce1000]

  - As per https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html
   you should first upgrade to 8.10.196.0 and try again , 8.3.x is very old ,

 M.

[MHM Cisco World]

require Message-auth <<- dont select this op in ISE and I think it will work 

MHM

[Vinicius Monteiro]

Hi guys, @marce1000 and @MHM Cisco World  thanks for the suggestions

Just to clarify in this environment I cannot apply an update as there are APs that are not supported in version 8.10 and not checking the option is also not an option as I am trying to mitigate CVE-2024-3596 Blast Radius, which ISE is vulnerable to

[marce1000]

   @Vinicius Monteiro wrote : >Just to clarify in this environment I cannot apply an update as there are APs that are not supported in version 8.10 
            - This should be considered a fatal showstopper these days ; the aireos models are EOL and using the last release made available has become mandatory for this type  of controllers.  If not being able to use the extra features because of a bug then there is nothing more then (anything more) then you can do , besides going back and not using that feature.
If the restriction is due to certain older AP  models , that also means that it is time to modernize the wireless network , 

 M.

[MHM Cisco World]

disable Op of allow protocol will apply to these AP only not all device 

MHM

[Rich R · Accepted solution]

@Vinicius Monteiro as per https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/222287-blast-radius-cve-2024-3596-protocol-sp.html not all radius clients will send message authenticator on all requests and the option should only be enabled where you know that the radius client will always use message authenticator.

As per https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk70846 AireOS will only send message authenticator for EAP authentication flows which is strictly compliant with RFCs at the time of implementation.  AireOS is end of life and this will not be changed (and certainly not ever in 8.3.x which is years past end of support!).  As per the bug notes - if you need to protect that radius traffic (if it is exposed to interception for example across the internet) then you should transport it in IPSEC.  If the radius is only transmitted across secure network links and devices (which you control and which should not be exposed to interception) then there is no real risk to start with.  In that case you add it to your Risk Register and note that it is mitigated by transport over secure, controlled networks.  If that's not good enough for your security team then ask them for the cash to upgrade all the equipment to current, supported technology.

> however in the other WLCs I do not have this problem, only in this 5502
I presume you mean 5520?
Are the other WLCs running the same version of code?
Are the radius flows all identical? (for example maybe the others are EAP?)