topic Ok thanks. Maybe you are in Network Access Control

ISE Guest Wireless

campbech1 — Mon, 11 Mar 2019 06:48:46 GMT

I'm moving all of our guest wireless access over to ISE and having some issues. The portal page is redirecting as it should, the ACLs are in place and working well, but if the user presses declined on the AUP page and then opens a browser window, they are allowed to surf the Internet.

I used the ISE wireless guest setup wizard so I would have thought this would have been a pretty easy setup.

Hi

Francesco Molino — Thu, 26 May 2016 17:27:56 GMT

On your guest portal configuration, where are you registering MAC address devices for Guest? In Which group?

Could you check that the user mac address is visible on Guest Endpoints and/or Registered Devices?

Could you give an output of the success authentication log?

Thanks

Hello,

campbech1 — Thu, 26 May 2016 18:29:12 GMT

Hello,

Attached are the screenshots from the logs.

Hello,

Thomas Wall — Thu, 26 May 2016 21:00:57 GMT

Hello,

I can see in the outputs that the end user is getting the correct rule and matching the GuestPermit rule after the user successfully authenticates to the guest portal and a Change of Authorization (COA) is issued. Once the guest authenticates to the page, they are automatically added to the GuestEndpoints group by default (This can be changed under the Guest Types menu option). Depending on the portal settings, acceptance of the AUP may not be a requirement. As such, can you please share the AUP settings of the portal itself under Guest Access > Guest Portals > Select the portal in use. From the portal settings, I would like to see the AUP Page Settings and the Self Registration Success Page settings(can force aup acceptance here)?

Lastly, can you please provide your version of ISE? Depending on your version of ISE, we could force the user to accept the AUP and then modify our authorization rules to look for guest who have accepted the aup within a given amount of time.

-Thomas

Ok thanks. Maybe you are

Francesco Molino — Thu, 26 May 2016 21:43:19 GMT

Ok thanks. Maybe you are registering mac addresses and that's why he is authenticated.

On the rule, in order to check that'sbdue to mac registration, could you add a condition like:

wireless_mab AND network_access:usecase EQUALS Guest Flow

thanks