Help adding new WLC to existing ACS

Federico Coto Fajardo · ‎05-12-2010

Hi All,

I need help with this.

This network has a working WLC that authenticates wireless users against an ACS by MAC address. It works fine.

I need to add a new WLC.

I added the WLC, the APs connect to the WLC fine, but the users get limited connectivity and we've found out that is because the new WLC is getting authentication errors against the ACS.

The configuration of the new WLC is exactly the same as the current working WLC and both controllers show as AAA clients on the ACS.

I want to know if somebody can point me out in the right direction to solve this.

There's connectivity fine between all devices (as far as PING goes), and there's no Firewall or filters in between.

The difference I see on both WLCs is that on the working one (WLC1), under Security - AP Policies, we see the AP Authorization List with the MAC addresses/cert type/hash. We don't get this information on the non-working WLC (attached document shows both)

Also in the attached document, I'm sending the errors I get no the WLC2 controller.

Any help is greatly appreciated.

Federico.

John Cook · ‎05-12-2010

What type of errors do you have in the ACS Failed Authentication logs?

Federico Coto Fajardo · ‎05-12-2010

Thank you.

In the ACS/Failed Attempts this is what I get:

05/12/2010

13:09:59

Authen failed

0024d2992d35

MacAddress

00-24-d2-99-2d-35

User Access Filtered

..

0024d2992d35

172.16.10.146

..

GN

wlcontroler-2

This happens for all the wireless clients connecting to APs for WLC2 (the one not working).

Please let me know.

Federico.

John Cook · ‎05-12-2010

The "user access filtered" message is likely caused by either the userid or group having Network Access Restrictions enabled for a the original AAA client, but not the new one. Check out the NAR settings in the user settings and group settings to see if that’s it.

Federico Coto Fajardo · ‎05-12-2010

Kindly help me out here please.

In the ACS, under Network Configuration/AAA Clients, I see both WLCs (both under a Network Device Group called (Not Assigned))

In the ACS, under Group Setup/MAC Address, I see only the WLC1

In the ACS, under Shared Profile Components/NAR, NAR is not defined (and is not showing under the group MAC Address)

Is this helping?

Federico.

Jatin Katyal · ‎05-14-2010

Federico,

I didn't get you when you say that you see only One WLC under groupsetup/Mac address. Could you please elaborate this?

Also, if you don't know see any NAR configured under shared profile component then check inside the group/user setup there must be either ip based or CLI/DNIS based NAR configured for WLC's and looking at failed attempts it seem that action is denied.

HTH

Regds,

JK

Do rate helpful posts-

~Jatin

Federico Coto Fajardo · ‎05-14-2010

In the ACS, under Group Setup/MAC Address, I see only the WLC1

Under the Group Setup option, I chose the group called MAC Address and only one WLC was showing (the working one).

I thought that it should recognize the WLC2, but after I added it manually it started working.

Not sure if it makes sense but it's now working fine, thank you.

Federico.