There seems to be something broken with Cisco WLC 8.3.140 and 143. 8.3 was the first AireOS release training to add MAC Filtering (CWA) and PSK. ISE is serving as the RADIUS server (v2.2).

I can get Win10/IOS devices to successfully redirect however it's a mixed result once devices are authenticated by CWA (hotspot/AUP). Clients drop the Wi-fi connection with CoA terminate, but do not rejoin and if they do rejoin they do not get an DHCP address any longer. If I use CoA reauthentication I see improved results, but I have to disable/renable my wifi adapter to connect and often times a reconnect later ton results in the same no dhcp address again.

Note this setup works fine with no PSK on the WLAN.

Mainly I'm looking for someone that has successfully same deployed this scenario on 8.3 and above and if so what WLC version is feature set working?

Cisco write-up: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/b_cg83_chapter_0100111.html#id_29449

Similar situation: https://community.arubanetworks.com/t5/Security/CPPM-guest-CoA-w-Cisco-WLC-and-server-initiated-auth-causes/td-p/362054

Possible bugs: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb10807

1 Answer 1


While introduced in 8.3, the feature combination does not work until 8.5 code train.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.