WLC9800 COA

[hs08]

I make ssid for guest where the user should enter the captive portal and enter the entra id user to acess to guest network. The environment used is WLC9800 and FortiNAC. When the user login to the SSID then the user will enter to isolation network to access the captive portal and after entra id successfull the from fortinac i can see the user already move from isolation to guest network but actually the client still sit under isolation network.

Based on this picture can we say that fortinac not send the CoA to the WLC?

[Mark Elsen]

  - @hs08                  Do you have COA enabled in the WLC 9800 configuration as in :
                                        aaa server radius dynamic-author
                                       client <FortiNAC-IP> server-key <key>
    and 
                                       radius server FORTINAC
                                       address ipv4 x.x.x.x auth-port 1812 acct-port 1813
                                       key XXXXX
                                       automate-tester username test

   Also make sure to enable : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/wlan-security.html#info-aaa-over

   Troubleshooting commands :

# Show wireless client summary
show wireless client summary

# Show client detail
show wireless client mac-address <MAC_ADDRESS> detail

# Show RADIUS server status
show aaa servers detailed

# Show AAA method lists
show aaa method-lists all

# Debug RADIUS transactions
debug radius all

          For : show aaa servers detailed 
                 Look for stats after  Author:

   + Use full client debugging according to :   https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
    Client debugs , so called Radio Active traces can be analyzed with : Wireless Debug Analyzer

   M.

[aleabrahao]

Check on the WLC if the dynamic-author (CoA) server is configured.

Example of required configuration:

aaa server radius dynamic-author
client <FortiNAC_IP_IP> server-key <secret>

Check the real-time CoA statistics by running the following command during the test:

show aaa servers dynamic-author

Debug on the WLC with the commands below:

debug radius coa enable
debug aaa all enable

If nothing appears during login, no CoA is being received.