WPA2+PSK with local webauth?

Question

Hi all, I'm trying to configure a guest wlan with WPA2+PSK and local webauth. This will authenticate against ISE and once authentication is complete dropped into a authz profile.
This is supposed to be possible per cisco's docs, however when I try to set this up on the WLAN I get the message:
Only PSK can be enabled for WPA with web-auth and Radius Nac.
Well, I've got only WPA with PSK configured. Is there any 'trick' to this config that I'm missing? I've got L2 security set to WPA+WPA2, WPA2 Policy and AES with only PSK configured. Under advanced I've got AAA override and NAC state sent to radius NAC. What else, that should be it right? I've tried it on multiple controllers with the same results every time.

Answer 1

That error is a little confusing and I don't think is a proper description of what the WLC is trying to tell you; there are actually a couple errors you may see depending on the combination of RADIUS NAC with L3 security.  Essentially, you shouldn't be able to enable RADIUS NAC if you're configured for a PSK.  What exactly are you trying to accomplish?  It sounds like you want ISE to perform CWA for your wireless guests, but you mention local webauth.  In order to do the CWA, you will use the mac-filtering option for L2 security and set security type to None.  This will allow you to specify the RADIUS NAC option correctly. 
When you say that "ISE will authenticate the users", how are you planning on doing this with a PSK WLAN, or are you intending that the local webauth will use RADIUS for authentication to ISE?  What is the end-user flow or experience you are expecting?  ie. user connects to guest, redirects, logs in, gets appropriate access. 
Please also post what version of ISE and WLC you are running so we can determine what features will and will not work.