topic Re: hotspot portal portal redirection issue in Network Access Control

hotspot portal portal redirection issue

aravikumar — Sat, 12 Oct 2019 00:18:03 GMT

I created the policy sets for hotspot portal but I am not seeing my endpoint redirecting to the portal. I am being allowed access to the internet. I am running ISE 2.4 p9. I have added the ise fqdn in dns. portal test URL is working. The guest flow is not working. I tried multiple combinations of guest flow but it is not working. Any help would be appreciated. I followed the cisco guide to configure this. But redirection is not happening. Instead of redirecting to the portal it is allowing internet access.

Attached is the policy set screenshot.

Thanks,

Aravind.

Re: hotspot portal portal redirection issue

Francesco Molino — Mon, 14 Oct 2019 04:33:58 GMT

Hi

We see 39 hits on your cwa rule which means some endpoints must be redirected when hitting that rule.

Can you share your cwa authorization details rule?
Is this for wireless or wired?
Can you share your wireless acl as well please?

Re: hotspot portal portal redirection issue

aravikumar — Mon, 14 Oct 2019 18:02:16 GMT

Hi Francesco,

Thank you for your timely response.

This is a wireless guest usecase. I have attached the redirection authz profile and the WLC ACL screenshots. Please let me know if something is missing. I am not being redirected to the portal.

Thanks,

Aravind.

Re: hotspot portal portal redirection issue

paul — Mon, 14 Oct 2019 18:35:33 GMT

If you look at the client details on the WLC is the user in CENTRAL_WEBAUTH_REQUIRED?

I always put a deny ip any any entry at the end of my redirect ACL, but should be implied.

Re: hotspot portal portal redirection issue

Francesco Molino — Tue, 15 Oct 2019 01:13:51 GMT

Can you take a screenshot of your user status?
Do you see the redirect acl in your user status?

Your line 3 doesn't make any sense.
Usually the redirect acl should be:
REDIRECT_ACL:
- Allow DNS (UDP and Dest port DNS) / Inbound Direction
- Allow DHCP / Inbound Direction
- Allow ISE / Inbound Direction
- Allow ANY / Outbound Direction

The source should be 0.0.0.0/0 but destination should match what given above. Can you test it and let us know?

Re: hotspot portal portal redirection issue

aravikumar — Tue, 15 Oct 2019 21:15:17 GMT

Hi Francesco,

Thank you for the corrections
So i can see redirection happening for windows workstation, iPhone and android. But Redirection is not happening for Macintosh. The captive portal pop up is coming but the actual ise portal is not loading on the macintosh machine.

I took packet captures on both windows(working) and mac(not working) endpoints. Any help would be appreciated.

Thanks,
Aravind.

Re: hotspot portal portal redirection issue

Jason Kunst — Tue, 15 Oct 2019 23:38:53 GMT

Please make sure you have a valid certificate installed for the portal.

Here are some recommendations
Http://cs.co/ise-guest check out prescriptive guide
https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Re: hotspot portal portal redirection issue

aravikumar — Wed, 16 Oct 2019 15:45:39 GMT

Hi Jason,

Thank you for your response. My portal certificate is signed by my internal CA and I am not using the default self signed certificate. I tried with endpoints that are not part of the domain for the guest usecase. As mentioned before the endpoints in this case are Macintosh, iPhone, Android Phone and Windows workstation. Though the macintosh is ttempting to load the redirection portal, it throws an error where "A problem occurred. The webpage couldn't be loaded". Does this mean the macintosh is not accepting the CA signed certificate presented by ISE?

Thanks,

Aravind.

Re: hotspot portal portal redirection issue

Francesco Molino — Thu, 17 Oct 2019 15:50:50 GMT

I'll look at your captures later and come back to you.
Can you detail the ise portal configuration? Is it in a different interface than the admin one? If so, the host is configured and machines are able to resolve the fqdn?

Re: hotspot portal portal redirection issue

Francesco Molino — Sun, 20 Oct 2019 02:41:36 GMT

Your mac client is 10.254.4.238.
I do see the redirect url on your capture, syn initiated by your ise and then your client doing a rst.

Do you have any firewalls on your client?

Re: hotspot portal portal redirection issue

aravikumar — Mon, 21 Oct 2019 18:25:34 GMT

Hi Francesco,

So the issue got resolved after i upgraded the Mac OS. I was able to see the captive portal pop up successfully.

Thanks for your help.

Thanks,

Aravind.