ISE Guest Portal login is not working

[BearingPoint]

Hello,

I have configured the Cisco ISE as a guest portal. The users can register themselves and then a sponsor has to approve them. This all works. I now have the problem that in the first phase, as soon as I click on the SSID, I am redirected and can do everything, but as soon as I want to log in, there is an error in the second phase.

I get the following error in the log.

Event 5417 Dynamic Authorization failed 
				
Failure Reason 11213 No response received from Network Access Device after sending a Dynamic Authorization request 

I have already checked. CoA is activated and allow AAA override is also set. An ACL with Aerospace ACL name was also specified in the Authorization Profile and this is also created on the WLC with Permit any any. (Permit any any because the firewall is supposed to manage all guest traffic)

The port udp 1700 is also permitted on the firewall.

Do you have any ideas as to what the problem might be?

BR Mario

[Aref Alsouqi]

Do you see any logs on the firewall for that CoA traffic going from ISE to the WLC and vice-versa? Please note that not only ISE needs to send a CoA request, but also the WLC would need to send a CoA ack back to ISE.

[BearingPoint]

I see the traffic from both sides. WLC towards ISE I see the protocols NEW-RADIUS (UDP 1812) and NEW-RADIUS-ACCOUNTING (UDP 1813) and these are allowed. ISE towards WLC I see traffic with port 1700 and this is also allowed.

[Aref Alsouqi]

If you run some packet capture on the firewall on the interface facing the WLC, do you see any CoA traffic coming from the WLC to ISE?

[BearingPoint]

What is also strange is that I sometimes see in the log that the Authorization Profile has been sent and an Accept is received, but I still cannot connect to the SSID, but the ISE shows it as a session. You can also see that the same device is also sending rejected requests, as shown in the previous document

[MHM Cisco World]

in these case I separate the issue into 
NAD 
ISE 
FW or router in path between NAD and ISE 
what I get from your last reply the FW/R is not drop the CoA between the ISE and NAD (WLC)
what is WLC platform and and is the ver. <<- it better to open new post in wireless for same issue it can be bug WLC ver. you run
MHM

[BearingPoint]

I opened a TAC Case - If I get an Solution I will post it

[MHM Cisco World]

Thanks a lot 

Have a nice day 

MHM

[Ping127001]

Hello, did you get a solution from your TAC ?

[BearingPoint]

Hello,

it was a configuration issue on the wlc.