WLC 5520 not responding for CoA which sent by ISE

[nwagh]

Hi,

We are getting below Alarm on ISE frequently. we verified COA enabled, Nac state ISE and aaa override enabled on WLC and there is no impact on users as we didnt receive any complain from users.
Dynamic Authorization Failed for Device : Server=ISE-1;

Network Device= 5520 WLC

WLC Firmware = 8.5.185.0

ISE Firmware = 2.7 patch 9

Distributed cluster for ISE which is 2 mnt,2 PAN and 2 PSN

Checked the firewall logs and noticed that we have logs on port 1700 (COA) from ISE to WLC but not from WLC to ISE.

Is there any solution to get rid of this alarm ? Is this a bug ? many thanks in advance

[nwagh]

Hi,

[nwagh]

We are getting below Alarm on ISE frequently. we verified COA enabled, Nac state ISE and aaa override enabled on WLC and there is no impact on users as we didnt receive any complain from users.
Dynamic Authorization Failed for Device : Server=ISE-1;

[nwagh]

Network Device= 5520 WLC

[nwagh]

WLC Firmware = 8.5.185.0

[nwagh]

ISE Firmware = 2.7 patch 9

[nwagh]

Distributed cluster for ISE which is 2 mnt,2 PAN and 2 PSN

[nwagh]

Checked the firewall logs and noticed that we have logs on port 1700 (COA) from ISE to WLC but not from WLC to ISE.

[nwagh]

Is there any solution to get rid of this alarm ? Is this a bug ? many thanks in advance

[MHM Cisco World]

support RFC 3576 must also selected 
Microsoft Word - Cisco WLC v8.0.120.0 - CoA setup guide.docx (odyssys.net)

[nwagh]

Thanks for the reply. Its enable and also manual CoA push from ISE is working.

[Dustin Anderson]

The issue is the client disconnects and the WLC doesn't notify ISE, so when ISE does a CoA to reauth or such, the client doesn't exist triggering the error message. I'm not sure if there is a fix, I have just purged the errors every so often.