topic If you don't need to leave in Network Access Control

Ise client ip flow during web auth

Mon, 11 Mar 2019 07:54:12 GMT

Hi everyone,

can it be explained what the client ip address flow is when it tries to connect to a guest ssid for example.

so far I understand the client dhcp to wireless and gets redirected to the ise portal when opening a browser. For connectivity at this point what would be the clients ip ? As it would not be assigned one from the dhcp pool as it has not authicated yet ...

Thanks

thetone

The client is given the IP

Marvin Rhoads — Mon, 31 Jul 2017 11:42:05 GMT

The client is given the IP address via DHCP but it is restricted by ACL to only be able to access the ISE portal.

Usually DNS is allowed in the ACL as well to be able to resolve the ISE portal FQDN.

Ok thanks Marvin.

Mon, 31 Jul 2017 17:31:04 GMT

Ok thanks Marvin.

Btw is it necessary to explicitly add dhcp in the redirect acl. If not which I have found though my dhcp server is on the same net as client and ap (in lab)

If you don't need to leave

Marvin Rhoads — Tue, 01 Aug 2017 03:54:55 GMT

If you don't need to leave the local subnet for DHCP services then - no, you don't need an ACL permitting that traffic.

It would be unusual to see that outside of a lab or very small environment though, so most guides will recommend including the ACL.