There seems to be something broken with Cisco WLC 8.3.140 and 143. 8.3 was the first AireOS release training to add MAC Filtering (CWA) and PSK. ISE is serving as the RADIUS server (v2.2).
I can get Win10/IOS devices to successfully redirect however it's a mixed result once devices are authenticated by CWA (hotspot/AUP). Clients drop the Wi-fi connection with CoA terminate, but do not rejoin and if they do rejoin they do not get an DHCP address any longer. If I use CoA reauthentication I see improved results, but I have to disable/renable my wifi adapter to connect and often times a reconnect later ton results in the same no dhcp address again.
Note this setup works fine with no PSK on the WLAN.
Mainly I'm looking for someone that has successfully same deployed this scenario on 8.3 and above and if so what WLC version is feature set working?
Cisco write-up: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/b_cg83_chapter_0100111.html#id_29449
Similar situation: https://community.arubanetworks.com/t5/Security/CPPM-guest-CoA-w-Cisco-WLC-and-server-initiated-auth-causes/td-p/362054
Possible bugs: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb10807
