ISE 1.2 Guest Access session expired

Question

We have set up the ISEs to allow wired guest users to logon with CWA but every time we get
"Your session has expired. Sign on again".
We successfully get to the portal and can logon, change password, accept conditions but then we just get the session expired page.
From the switch (some data redacted fro privacy):
sw01#sh auth ses int f0/1
            Interface:  FastEthernet0/1
          MAC Address:  0021.xxda.xx28
           IP Address:  xxx.xx.40.45
            User-Name:  00-21-xx-DA-xx-28
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-domain
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  901
              ACS ACL:  xACSACLx-IP_GuestWired_ISE_Portal_Access-53182da8
     URL Redirect ACL:  dot1x_WEBAUTH-REDIRECT
         URL Redirect:  https://guest.ourdomain.com:8443/guestportal/gateway?sessionId=AC1262FB000000FA0FCEFDB8&portal=TT_GuestPortal&action=cwa
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  AC1262FB000000FA0FCEFDB8
      Acct Session ID:  0x000001CF
               Handle:  0x370000FB
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
The ISE reports a failed login
Event
5418 Guest Authentication Failed
Failure Reason
86017
Now the reason appears to be that the guest portal being accesed is on an ISE in our DMZ but the RADIUS/MAB authentication is done by our internal ISEs (all ISEs are part of the same cluster however).  This is because the NAD is a switch and its management interface is on the inside of the network while  the guest VLAN is in a DMZ.  If we authenticate the RADIUS and guest on the same ISE (by breaking routing/security) then the access is granted and it all works corrcetly.
We are summarising that the session ID sent by the RADIUS ISE server is not avaialble to the Guest Portal ISE server so the session ID does not exist in the session cache.
So does the  guest portal ISE server have to be the same ISE server that does the RADIUS/MAB session generation?  There is no obvious way to tie a FQDN (e.g. guest.ourdomain.com) to the ISE used by the NAD.
Should the session ID not be shared across all enforcement nodes?
Any other ideas or thoughts?
Chris Davis

Answer 1

Thanks Jan, do you know if this is by design, even across nodes in node groups?  I'm guessing that Bug CSCul10677 is the same issue.
Thing is, it rather makes the CWA static IP/Hostname option redundant/useless in a resilient configuration.  It also means that the NAD must use the guest network for dot1x traffic or that the guest nework must be able to route over/into the internal network neither of which appear to be ideal from a security perspective...