WLC logs Authentication failed for client xxx ACL override mismatch from AAA server

[#1]

Hi,

Have simple setup where the wlc uses ISE for Radius for AAA , and get this message 

%APF-3-CLIENT_NO_ACCESS: Authentication failed for client: 74:8d:08:6a:f1:43. ACL override mismatch from AAA server

The authC policy checks wireless MAB and default network access and continue if user not found.

At this point the from the ISE does not show an error, but the wlc displays the above error in the log, and the user is not able to connect to the WLAN .

Any useful suggestions would be great 

[Francesco Molino]

Hi 

Is there a firewall between your ise and wlc? 

They communicate for CoA over udp/1700.

What are the logs on ISE? 

Was it working before? 

Does the acl name between ISE  profile and wlc are exactly the same (case sensitive).

Thanks 

PS: Please don't forget to rate and mark as correct answer if this answered your question

[#3]

Hi Franceso,

no f/w. yes it was working before. Will double check the acl names 

thanks

[Francesco Molino]

Ok let us know. Otherwise gives us the full ISE log for that specific authentication into a text file. 

Thanks 

PS: Please don't forget to rate and mark as correct answer if this answered your question

[#5]

Hi Franceso,

I've attached the log but no issues here but get this error in the wlc

*apfReceiveTask: Jul 10 13:14:36.368: %APF-3-CLIENT_NO_ACCESS: apf_80211.c:4395 Authentication failed for client: 74:8d:08:6a:f1:43. ACL override mismatch from AAA server.

when you try to associate to the ssid it disconnects you very quickly

Cheers

Tony

[Francesco Molino]

Hi Tony

This log is the 1st step when your user is redirected to the portal. 

Are you redirected well to the portal? 

The issue occurs after portal login right? 

Do you have any logs on ISE regarding that step? 

Thanks

[#7]

Hi Franceso,

now resolved ! 

It was the acl on the wlc under 

All APs > ap1 >External WebAuth ACL Mappings that had not been applied

Can you believe that !

I well good learning curve for me on this one 

ciao

[Francesco Molino]

Hi 

Nice to hear that everything is good now. 

Thanks 

PS: Please don't forget to rate and mark as correct answer if this answered your question