Hi,
Have you had a look at the AAA server statistics, will list number of auth requests, passes, fails, timeout etc.. example output below, may help focus the investigation. Of course a ‘debug client <mac>’ always helps Example output: (wlc01) >show radius auth statistics Authentication Servers: Server Index..................................... 1 Server Address................................... 10.203.251.110 Msg Round Trip Time.............................. 41087 (usec) Average Msg Round Trip Time...................... 154 (usec) Exponential Msg Round Trip Time.................. 37068 (usec) First Requests................................... 303910 Retry Requests................................... 42 Accept Responses................................. 22698 Reject Responses................................. 213 Challenge Responses.............................. 280986 Malformed Msgs................................... 0 Bad Authenticator Msgs........................... 0 Pending Requests................................. 0 Timeout Requests................................. 42 Consecutive Drops ............................... 0 Unknowntype Msgs................................. 0 Other Drops...................................... 13 AuthZ Requests................................... 0 AuthZ Accept Responses........................... 0 AuthZ Reject Responses........................... 0 --More-- or (q)uit Server Index..................................... 2 Server Address................................... 10.128.50.42 Msg Round Trip Time.............................. 154643 (usec) Average Msg Round Trip Time...................... 163837 (usec) Exponential Msg Round Trip Time.................. 208352 (usec) First Requests................................... 24776 Retry Requests................................... 34 Accept Responses................................. 24380 Reject Responses................................. 396 Challenge Responses.............................. 0 Malformed Msgs................................... 0 Bad Authenticator Msgs........................... 0 Pending Requests................................. 0 Timeout Requests................................. 34 Consecutive Drops ............................... 0 Unknowntype Msgs................................. 0 Other Drops...................................... 0 AuthZ Requests................................... 0 AuthZ Accept Responses........................... 0 AuthZ Reject Responses........................... 0 From: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Mathieu Sturm <mathieu.st...@hogent.be> Reply-To: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Date: Wednesday, 9 October 2019 at 08:11 To: <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] WLC & ISE combo issues The WLC is on version 8.3.140.0 (we still have 2600 series AP’s that we need to replace so we are pretty limited) and ISE is 2.2 (patch 5). Van: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Namens Letts, Richard J Verzonden: dinsdag 8 oktober 2019 22:41 Aan: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Onderwerp: Re: [WIRELESS-LAN] WLC & ISE combo issues What version of core on the WLC / what model of AP? We had an issue at the start of the year with version of code on cisco 3500 series AP where clients would successful authenticate with the AP, but the association would never get passed from the AP through to the controller and thence on to the ISE. Clients would get a ‘bad password’ (or similar type of error) displayed on their computer which would confuse them, and there would be nothing recorded in the WLC or ISE logs. Authentication and Association isn’t the way around people normally think of this. https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/802.11_Association_process_explained anyway, I think you’re going to need to include version numbers of the ISE and WLC code for more help. Thank you Richard Letts From: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> On Behalf Of Mathieu Sturm Sent: Tuesday, October 8, 2019 2:50 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Subject: [WIRELESS-LAN] WLC & ISE combo issues Hello, since the start of the new academic year we’ve been having some troubles with our Cisco setup. We have 3 Cisco WLC 5520’s (one of these is standby), around 850ap’s and 5 Cisco ISE’s (1 admin node, 1 monitor node and 3 radius-only nodes). We have this setup since 2018. There were some problems sometimes but nothing major. Now recently it’s taking a long time for people to get connected. We have around 20k students and 3K staff with peaks to nearly 9K associations. The problem is that it is difficult to get connected sometimes. I see the user trying to connect in the WLC’s but don’t see them trying in the ISE’s (it looks like the attempt gets lost somewher). I can see the following worrying log message in the wlc: RADIUS auth-server X.X.X.X unavailable Or These logs in the ISE 5441 Endpoint started new session while the packet of previous session is being processed. Dropping new session. 12930 Supplicant stopped responding to ISE after sending it the first PEAP message It looks like there is some sort of bottleneck between WLC and ISE. Further information: the identity store is a bunch of Windows Domain Controllers (6 in total). Any ideas? Mathieu Sturm Hoofdmedewerker Netwerkbeheer Directie Financiën, Infrastructuur en IT Afdeling Netwerkbeheer Campus Schoonmeerssen - Gebouw B Lokaal B0.75 Valentin Vaerwyckweg 1 - 9000 Gent +32 9 243 35 23 www.hogent.be ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
