topic Re: ISE 2.7 guest flow issue in Network Access Control

ISE 2.7 guest flow issue

Jiri Krystynek — Fri, 06 Dec 2019 06:05:30 GMT

Hi,

I tried guest flow in ISE 2.7 and I'm facing issue with initial MAC authentication for redirect. I have standard configuration - identity source Guest Users with "If User now found" option set to Continue - the standard settings I guess.

When the MAC arrive from WLC the authentication fails with Process fail. When I set identity source Internal Endpoints it works. Something changed in the 2.7 version or it's a bug?

Thanks,

Jiri

Re: ISE 2.7 guest flow issue

howon — Sat, 07 Dec 2019 00:14:11 GMT

For ISE Central WebAuth, it always has been required to setup Internal Endpoints for the identity source in the policy set. The guest users or any other identity source sequence is defined on the portal it self.

Re: ISE 2.7 guest flow issue

Jason Kunst — Sun, 08 Dec 2019 17:34:07 GMT

@Jiri Krystynek wrote:

Hi,

I tried guest flow in ISE 2.7 and I'm facing issue with initial MAC authentication for redirect. I have standard configuration - identity source Guest Users with "If User now found" option set to Continue - the standard settings I guess.

When the MAC arrive from WLC the authentication fails with Process fail. When I set identity source Internal Endpoints it works. Something changed in the 2.7 version or it's a bug?

Thanks,

Jiri

Depends on how you configured it. If you used the defaults policies then it should work. If you created a new auth policy then you will likely need to change it

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

Re: ISE 2.7 guest flow issue

Jiri Krystynek — Sun, 08 Dec 2019 21:40:11 GMT

Hi,

thank you all for the replies. I'm using ISE guest for several years and version with Guest Users identity sources and everything worked fine. I thought that it's needed for the second authentication (guest account). Probably it works a little different that I thought. Never mind I can change it easily.

But still there's something different in the 2.7. I don't think it should end up with process failed, I would expect that it ends on User not Found.

Thanks,

Jiri

Re: ISE 2.7 guest flow issue

Jiri Krystynek — Mon, 09 Dec 2019 13:01:21 GMT

Hi,

changing identity source to Internal Endpoints fixed the issue.

Thank you for the help.

Jiri

Re: ISE 2.7 guest flow issue

Jason Kunst — Mon, 09 Dec 2019 16:34:01 GMT

@Jiri Krystynek wrote:

Hi,

changing identity source to Internal Endpoints fixed the issue.

Thank you for the help.

Jiri

Was it a new policy set or the built-in please?