AAA, NAC, Guest Access & BYOD

Problem:

Receive an error invalid response from publisher(no session key in response) while clicking manage accounts in guest module of subscriber node

From application log of subscriber, we can see that cluster replication happens only between management port in cluster nodes:

In this scenario, Subscriber makes a request using curl to a PHP script on Publisher. This request would be sourced from data port of subscriber if the management port of subscriber is in a different subnet as that of Publisher.

As Publisher accepts connection only from management port in Cluster, we would notice the above error.

Create static route in subscriber node. This will route management traffic from subscriber to publisher via management port .

This can be achieved using below command on the subscriber node:

network ip add mgmt -d <publisher management IP>

After adding above route, when we click manage accounts, we will not see the above error and also will be able to see the guest accounts replicated from publisher.

Also while using guest registration if sponsorship confirmation is enabled, sponsor will not be able to approve if manage accounts throws above error . As guest accounts will not be replicated from publisher to subscriber because of above error, when sponsor gets redirected to approve the guest user, an invalid guest registration token error will be thrown while sponsor approval as guest account is not replicated to subscriber node.