WLC 9800 L authentication

[TRNnHelp]

I have a WLC 9800 L controller with 2 WLAN's.  One with AAA Radius and Mac authentication.  It is working without issue.  The 2nd one is a Guest WLAN. It works without issue if I choose Consent as the authentication.  But fails if I try to use Web Authentication or webconsent. 

The message in syslog is Authc fail. Authc Failure reason No response from client.

Any help is appreciated

[Sandeep Choudhary]

how did you configure the webuthon 9800 wlc ?

[TRNnHelp]

I create AAA method list Authenication

[marce1000]

-  Review the 9800   L current configuration with the CLI command : show  tech   wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.               Checkout all advisories!

 M.

[TRNnHelp]

Ethernet TW2GB0/0/1

Dynamic desirable  (Dynamic Auto also works)

Vlan222

Native LAN 1

AAA Method List >

Authentication >Guest Type Login  >  Group Type Local

Authorization > Guest type Network  > Group Type Local

AAA Advanced

Attribute list name Guest attribute

Security > Guest User > Guest and Guest2

Webauth > Global > Virtual IPV4 192.0.2.1

Webconsent ( Tried web Auth, Webconsent, and Consent) Consent works but the other 2 do not

WLAN Guest > layer3 -Web Policy >Web Auth Parameter map > Global > have also tried with one I created

Authentication list > Guest

ProfilePolicy > Guest > VLAN222

I ran the show tech wireless and ran the analyzer and there are no errors.  I connect to the controller but weather I use a guest user that exists or one that doesn't exist I get authentication failed.  I can do an NSlookup successfully  to www.cisco.com and www.google.com but I cannot authenticate to get internet access.  

I have gone thru multiple documents for configuration and it seems no matter what I change I still cannot authenticate. 

[marce1000]

 - You may want to do some client debugging , check : https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKEWN-3013.pdf , look for RA Traces , you can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer/

 M.

[TRNnHelp]

I ran the  traces and analyzed but all I get is Credential authentication failure during layer 3 authentication.  I have created different user and passwords on the controller under guest users and this is the error in the trace no matter what account I use.

[Rich R]

Did you follow every step in the guide?
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/web-authentication/b-configuring-web-based-authentication-on-cisco-catalyst-9800-series-controllers/m-local-web-authentication-configuration.html

[TRNnHelp]

Yes I have followed that guide and here is the error Credential authentication failure during layer 3 authentication

[marce1000 · Accepted solution]

 - Check this thread : https://community.cisco.com/t5/wireless/guest-user-for-webauth-not-working/td-p/4766554

 M.