topic LWA Support for Provisioning in Network Access Control

LWA Support for Provisioning

zztopping — Mon, 11 Mar 2019 02:42:31 GMT

My Desired flow is:

Guest SSID - Open Access.

If WebAuths as a Guest User, apply ACL-GUEST-ACCESS and stop

If webauth's as a user that is a member of AD group X, go to client provisioning portal.

I've tried using CWA, and I get "We are unable to determine access privileges in order to access the network. Please contact your administrator."

Since the 4400 and 2100 WLCs are supported for ISE using LWA only (no CWA support), I think this is why.

The below log appears in the authentications screen: (not very helpful is it)

So I think I need to do a AuthZ rule resulting in a profile using webauth against the provisioning portal, not CWA? If so, I can't seem to wrap my head around a workable rule to match this. Any hints on making this work? All the TrustSec 2.0 and 2.1 docs center around CWA only.

LWA Support for Provisioning

nspasov — Wed, 31 Oct 2012 02:11:16 GMT

When you use LWA (Local Web Authentication) the NAD device (Switch, wireless lan controller, etc) is providing the Web Authentication Services. For example, on the WLC clients get redirected to the built-in WebAuth Guest page. As a result, the clients will never reach ISE for them to utilize the web services (web auth, device registration, provisioning etc). You will need to run version 7.2 and above on your WLC and use CWA. I hope this makes sense.

Thank you for rating!

LWA Support for Provisioning

manjeets — Wed, 22 May 2013 09:31:22 GMT

Kindly review the below link:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html