WLC 9800 Guest SSID not redirecting to Guest Portal in Clearpass

[axom789]

Hi All,

We have an issue where the Guest Client (SSID in WLC9800) gets an IP from the DHCP server (in Fortigate) but it never reaches the clearpass server (from what I understand from the logs). I have followed the below procedure. Checked all firewall policies. I also double checked the Redirect ACL multiple times and do not see any issue. From the WLC i can ping the Clearpass server fine. 

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217931-configure-9800-wlc-and-aruba-clearpass.html#toc-hId-2126303558
We have other Radius and Tacacs requests from the same controller to the Radius server which works fine. The issue is only with the guest ssid. 

Logs in WLC:

%RADIUS_AUDIT_MESSAGE-6-RADIUS_DEAD: Chassis 1 R0/0: wncd: RADIUS server x.x.x.x:1812,1813 is not responding.

%CLIENT_EXCLUSION_SERVER-5-ADD_TO_EXCLUSIONLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: xxxx.0ffb.xxxx was added to exclusion list associated with AP Name:NY-FORUM-15, BSSID:MAC: 0000.0000.0000, reason:802.11 association failure

%SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (xxxx.0ffb.xxxx) on Interface capwap_900000bb AuditSessionID 1F0110AC00093797A393D9BF. Failure reason: Authc fail. Authc failure reason: AAA Server Down.

%SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (xxxx.0ffb.xxxx) on Interface capwap_9000011d AuditSessionID 1F0110AC00093796A393D925. Failure reason: Authc fail. Authc failure reason: AAA Server Down.

I am fairly new to wireless world and still learning. Any advise is greatly appreciated.

[marce1000]

 - It seems that the controller can not reach the radius server for the clients using the Guest SSID. For starters check the logs on the used radius server too when those clients try to connect , 

 M.

[axom789]

There is no hit/logs on the Radius server when i look up the device.

[marce1000]

                 >...There is no hit/logs on the Radius server when i look up the device.
  - Then you must review the WAN settings for the Guest SSID , look where the radius servers are defined and check for correctness (also check reachability of the radius servers from the controller)
     +  Use https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA
      for guest access troubleshooting
     + Also have a checkup of the 9800 WLC configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer
                                        use the full command as denoted in green, do not use a simple show tech as input for this
    procedure 
   + Further engage in full client debugging according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

 -+ Outputs from the commands mentioned in https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5 can also be useful when changes are made

 M.

[MHM Cisco World]

You need to open port from Wlc to Aruba include two radius port and coa port and dns and http port 

These ports open in FW

MHM

[axom789]

For one site we already have this guest ssid working. Can you please advise on where else I should look in the wlc to confirm the opened ports ? 

[MHM Cisco World]

In FW

The WLC will use mgmt IP or vlan guest IP to connect to radius if radius behind FW then these port must open

MHM

[axom789]

I'll double check fw and revert. 

[axom789]

So, the radius port udp 1813 1812, dns, https and https are open.  

[Rich R]

You need to map the source and destination for the traffic flows.
DNS, http and https will be from the client.
Radius will be from the WLC.

[axom789]

Thanks but i am really confused of the traffic flow in this situation.

The wlc is in aws. I also have a public ip mapped to the private ip of the clearpass server as this is a guest ssid.

Please correct me if i am wrong but the traffic flow in this case is - Guest Client - AP - WLC (AWS)- FW (hairpin nat configured) - FW - Radius. 

[Rich R]

802.1x is a layer 2 interaction between client <-> AP, the client never communicates directly with radius at layer 3 because the authentication happens before the client even gets an IP address.

The radius communication is between WLC <-> radius server (central authentication) or AP <-> radius server (flexconnect local authentication or local fall-back).  The client authentication details are encapsulated in the radius packets.

[Rich R]

And remember to reach the portal the client must be able to reach the server, not just the WLC.
So get the radius working - which could be a routing or ACL or firewall or radius pre-shared key issue and make sure WLC is a recognised client on the radius server.  As MHM said you must also allow CoA traffic from radius > WLC.
Refer to https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html and https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_central_web_authentication.html
This document is old but nicely summarises all the ports and protocols:
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html
And I just realised the current info is included in the release notes: Network Protocols and Port Matrix