[ 400 ] Bad Request,The request is invalid due to malformed syntax or invalid data.

Joseph Fontenot · ‎10-25-2016

We have two ISE nodes (v2.0.0.306) one primary and one set to secondary. We suddenly having an issue with clients authenticating with wifi. When a client connects to a particular guest wifi network they get the 400 bad request error. If we go to Web Redirection (CWA, MDM, NSP, CPP) -> Static IP/Host name/FQDN and change the host name to the secondary server the problem goes away but if it is set to the primary device it does not work. We have also noticed that the primary node does not have the CA service running but the second node does. Could this be the issue? Apparently it is disabled on the primary node. Also in the ISE web administration under Administration - Certificate Authority - Internal CA Settings both nodes are listed but there is the button at the top to "Enable Certificate Authority" Shouldn't this button say Disable not enable since it is setup and working.

jan.nielsen · ‎10-26-2016

Make sure that you are redirecting to the same ISE that your WLC is actually sending it's radius requests to, otherwise it will fail. The easiest way is to simply not change the "host name" field at all, leave it unused, as ISE will fill in the proper ise server dynamically.

Remember that the WLC can choose to use either of the ISE servers, if any client fails to authenticate, ISE will stop responding, which can trigger the WLC to try and use the other ISE server. So check you ISE logs, to see which ise gets the mab request initially, and see if it's the same ise you are getting redirected to.

The CA Service is not related to portals

Joseph Fontenot · ‎10-26-2016

So should we uncheck the "Static IP/Host name/FQDN" option under the "Web Redirection (CWA, MDM, NSP, CPP)" settings? Assuming this will allow ISE to auto decide?

jan.nielsen · ‎10-26-2016

Exactly.

You should be aware that ise will use it's own configured fqdn per default when it auto-selects what should be in the redirect url. If you need to change that, due to DNS/Certificate contents or others, you can do alias commands in the CLI, or create one authorization rule that matches per ISE server, that then sends two different hardcoded fqdns.

Boniek · ‎09-29-2017

Thanks. That was quick and easy solution.