topic ISE posture redirect not working in Network Access Control

ISE posture redirect not working

grant.maynard — Mon, 11 Mar 2019 02:13:34 GMT

ISE v1.1.0.665, 3395 h/w.

Single Admin/Monitor/Policy node.

WS-C3560-48TS 12.2(55)SE5 C3560-IPBASEK9-M

For Client Provisioning I created an authorisation policy as follows:

download acl "ACL-POSTURE-REMEDIATION"

apply url redirect "ACL-POSTURE-REDIRECT".

"Debug radius" shows all this is downloaded to the switch but:

- Redirect does not work.

- dACL is not applied if the URL redirect is also configured.

Wireshark on the client shows no direct.

Attached file shows "debug radius" for various combinations of authorisation policy i.e. dACL only, Redirect only, dACL + Redirect.

I've also attached screen shots of these policies and wireshark.

ISE posture redirect not working

Tarik Admani — Sun, 24 Jun 2012 03:51:48 GMT

Grant,

It looks like you are changing the vlan after your client gets an ip address, it seems like the client gets an ip address of

192.168.16.164 and you are changing the vlan over to 516. I wanted to know if that is there isnt an ip to vlan mismatch before you move forward. If 516 is quarantine vlan you may want to start all clients on that vlan and use dynamic vlan assignment through change of authorization once a client becomes compliant. The reason is is that you can use the web portal, or the nac agent to change the ip address once the vlan is changed.

Thanks,

Tarik Admani