ISE 1.2 CWA with Multiple PSNs - SessionID Replication / Session Expired

Advertisement
October 11

Hi all.
I have a (2) Policy Services Nodes (PSNs) in an ISE 1.2 deployment running patch 1. We are using Wireless MAB and CWA on 5760 Wireless LAN Controllers running v3.3.3.
We are hitting an issue wherein a client first passes MAB and then gets redirected to a CWA custom portal. The client then receives a Session Expired message. This seems to be related to the fact that CWA is technically a 2-stage authentication (MAB by the WLC and then CWA by the client). Specifically, it seems to happen when the WLC makes its MAB RADIUS access-request to PSN-1 and then the client comes in to PSN-2 to complete the CWA. This issue does not happen when only one PSN is in use and all authentication traffic (both MAB RADIUS and CWA) is directed at a single PSN.
Clients resolve the FQDN in the redirect URL using public DNS and a public DNS zone file (call it cwa-portal.example.com). cwa-portal.example.com has two A records for the two PSN nodes. DNS is responding to queries using DNS round-robin.
I have the PSNs configured in a Node Group for session information replication between PSNs, but this doesn't seem to make a difference in behavior.
So I ask:
What is the recommended architecture for CWA when using more than one PSN? It seems that you would need to keep the two authentication flows pinned together so that they both hit the same PSN when using more than one PSN in a deployment. A load balancer balancing on the SessionID string comes to mind (both the RADIUS MAB request and the CWA URL contain this unique per-client SessionID), but that seems terribly overbuilt for a seemingly simple problem. On the other hand, it also seems like using a Node Group setup should easily be able to replicate client SessionIDs to all nodes in the deployment so that this isn't an issue. I.e., if the WLC authenticates MAB on PSN-1, then PSN-1 should tell the Node Group about it such that when the client CWA's on PSN-2, PSN-2 doesn't respond with a Session Expired message.
Is there any Cisco documentation that talks about this?
Possibly related:
https://supportforums.cisco.com/discussion/12131531/ise-12-guest-access-session-expired
Justin

Advertisement

Replay

Tim,
Thanks for your reply and confirming my suspicion. Hopefully a future version of ISE will provide automated SessionID synchronization among PSNs so that front-end finagling in a multi-PSN environment won't be necessary.
For anyone else with this issue who for whatever reason can't implement a load balancer(s), I built an automated EEM applet running on a "watchdog" switch (3750 running 12.2(55)SEE9) using IPSLA tracking that senses when PSN1 is down and then
modifies an ASA to change its client-facing NAT statement for PSN1 to PSN2
modifies the primary and HA wireless LAN controllers to change its MAB RADIUS aaa server group to use PSN2
reverts the ASA and WLCs to using PSN1 when PSN1 is detected up and running again
The applet ensures the SessionID authentications stay "glued" together so that both WLCs and the client hit the same PSN for both stages of authentication. It's failover only, not a load balancing solution, but it meets our current project's need for an automated HA environment.
PM me if you want the code. I'm have a little too much going on ATM to sanitize and post it. :)
Justin

View 3 Replies

Dealing with multiples windows within a session (servlets & JSPs)

November 30

Hi, How can I show multiple windows during a session and avoid terminating the current session when one of those windows is closed? I have a main window through which the client navigates from page to page using servlets and JSPs. But if he opens the

View All Replies

Cannot Open the URL of CWA with ISE

November 30

Hi Folks, I have a problem when doing the CWA with ISE so that I can Provide the access of the network for the guests. Everything goes fine except the URL of the CWA: When the guests open the explorer and enter a domain after connecting the SSID, the

View All Replies

Help with multiple httpservice calls

November 30

I need help with multiple httpservice call back to back, doing 10 different mysql query at startup of the app loading results into 14 datagrids/combobox all queries are to different tables.Hello, I think what Grizzzzzzzzzz means is the following:    

View All Replies

How can I convert video for iPhone with multiple audio/subtitle? (I am using Windows)

November 30

Handbreak is available on Windows platform, however its conversion speed is too slow! I hope there are some tools that can combine my converted video together with my audio track and subtitle, and I can select between audio or subtitle inside my iPho

View All Replies

Audiences with multiple "Reports Under" rules

November 30

I am creating an audience with multiple "Reports Under" rules with the "Members satisfy any of the rules" option. Steps Create the audience. Choose Members satisfy any of the rules Choose Reports Under and specify a value (manager one 

View All Replies

Iphoto/preview crashing with multiple user accounts

November 30

Hi everybody, I'm stuck for a while now with my iMac and parental controlled user accounts. It's for a few months now iPhoto and Preview keep crashing at starting up in these other accounts. All works fine in my own administrator account. I'll copy a

View All Replies

Download to excel with multiple lines in header

October 11

Hi experts, Is there any Funtion module available to download an internal table contents into Local directory of PC with multiple lines in header. i.e.  let us say i hv internal table of 5 entries with 3 columns... i need to download this 5 entries i

View All Replies

String Array declaration with multiple lines

October 11

I have an array declaration with several indexes where it covers multiple lines. Please advise if this is the best way to declare an array declaration with multiple lines: String cityString = "San Diego, Oakland, London, New York, Dublin," + &qu

View All Replies

How to insert autoincrement record and query it with multiple keys

November 30

Hi all, I am not familiar with BerkeyleyDB, I am now doing a project that needs to insert records and then query it out with multiple keys at later time. Since there is no field that can be distinct primary key, I want to user DbSequence as auto incr

View All Replies

JTable with Multiple Row Header

November 30

well, Im do an application thats need formated ISOS Sheets, and most of them have a Table with Multiple Row Header , and Groupable Header, and both of them. I have the .java and in the class MultipleRowHeaderExample calls a class AttributiveCellTable

View All Replies

SAP Cloud SDK : Send E-mail with multiple existing attachments

November 30

Hi Experts, I have some requirements from our clients. 1) Can we send email with multiple existing attachments to employee? I know that we can send email with attachment but how to add existing attachments to the email and send it to user. 2) Can we

View All Replies

Is it currently possible to create a doughnut chart with multiple concentric circles in SSRS?

October 11

Is there currently any way to create a 'doughnut' chart with multiple concentric circles in an SSRS report (any version), without using 3rd party tools? Something like this, perhaps? (For that matter is it possible to create this using JavaScript?  I

View All Replies

HT2688 Working on a single computer with multiple users, I have set things up to allow each user to view and listen to the others' music libraries under the "Shared Library" function.  Can you then connect an iPod touch and copy music from a shared librar

October 11

Working on a single computer with multiple users, I have set things up to allow each user to view and listen to the others' music libraries under the "Shared Library" function.  Can you then connect an iPod touch and copy music from a shared lib

View All Replies

Would like assistance with multiple devices with multiple iTunes accounts syncing on one PC

October 11

I have had an iPhone for some years now and have been syncing with my PC without issue (first with iPhone 3gs and now with iPhone 4s). My wife bought me an iPad 3 retina in December 2012 which syncs with the same PC as my phone and shares the same iT

View All Replies

Bursting a report with multiple queries

October 11

Hi, I need to set-up bursting in BIP for a report with multiple queries. The output format is pdf and delivery is through e-mail. Since the queries need to be linked, I'm trying to do this using data template. I've set-up split and burst based on a f

View All Replies

Adhoc Query Requirement with Multiple Data Source

November 30

Hi All, I have a Adhoc Query Requirement with Multiple Data Source. Is there any way to achive it. Other than Resultant set and bring into Model. Thanks SSYou can compare stuff in the EL, but I don't think this is what you need. You can just use Java

View All Replies

Problems with Multiple Numeric Limit Test

November 30

Hi, I'm trying to use the MultipleNumeric Limit test and I have problems with it 1) Since I use TestStand 3.1, is it recommended to uses the new type template rather than the legacy one? 2) When you let TestStand creat the test code for you it gives

View All Replies

DSD route settlement with multiple sales are

November 30

Hi folks, I have looked in this forum for an answer for my problem but haven't found any, so i am creating this new thread. Well i am trying to settle a shipment in /DSD/DE_ENTRY transaction with multiple sales area in it, example: Visit 1 - Sales Or

View All Replies

Create Service Request with Multiple Choices

November 30

Dears, I need to create Service Request to appear in the portal with Multiple Choices like blow  Mohamed Fawzi | http://fawzi.wordpress.comHi Mohamed. I am sitting almost in the same sudation, I am designing a service request form in the portal and w

View All Replies

Tags:

  1. bapi mir7 for asset order
  2. Backup easyserver has stopped
  3. apple error code 4men 9
  4. ba amex cli when bad credit
  5. mass confirm vendor
  6. backup-spsite when to use sqlsnapshot
  7. sap configure ke24
  8. CL_SQL_RESULT_SET=============CP
  9. E317
  10. stepa89
Copyrights 2019 Fcffair BigData Resource, All rights reserved