topic Issues Post-Login on ISE Portal Integrated with Cisco Controller in Network Access Control

Issues Post-Login on ISE Portal Integrated with Cisco Controller

s1nsp4wn — Fri, 26 Jul 2019 19:34:11 GMT

Trying to set up sponsored guest portal access between ise 2.4 and our cisco wireless controllers per directions I found here and while I'm able to authenticate successfully, nothing appears after "You now have internet access" on my iPhone. I get absolutely nothing on Android. If I change the Authentication Success Status in ISE to point to a specific URL, I just looped back to the login for the portal endlessly. I've checked my acl on the controller and it explicitly allows traffic to and from the ise psn to anywhere in addition to udp dns being allowed anywhere. Am I supposed to create a another policy with a different less-restrictive acl? Adding permit statements to the redirect acl (even if I deny rfc 1918) just bypasses the portal altogether.

Can someone help? If I use the directions below this just bypasses the portal altogether:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

Re: Issues Post-Login on ISE Portal Integrated with Cisco Controller

hslai — Sat, 27 Jul 2019 03:37:56 GMT

Please follow the instructions at ISE Guest Access Prescriptive Deployment Guide, instead. The guide you cited is rather old.

We do need two different authorization policy rules; one for URL redirect and the other to grant access after passing authentication, AUP, etc.

Below shows a screenshot RADIUS LiveLogs from our lab, with an endpoint redirect to Web Auth portal, an AD user logged-in guest portal, and granted Employees access. I rearranged the columns and filtered on Session ID so easier to see all the events for the same Session.

Re: Issues Post-Login on ISE Portal Integrated with Cisco Controller

s1nsp4wn — Mon, 29 Jul 2019 15:40:14 GMT

Are switch configs still necessary if I'm only testing phone > wireless controller > ISE?

Re: Issues Post-Login on ISE Portal Integrated with Cisco Controller

hslai — Mon, 29 Jul 2019 17:05:58 GMT

Are switch configs still necessary if I'm only testing phone > wireless controller > ISE?

No, only WLC.

Also take a look at ISE Secure Access Wizard (SAW) > Guest

Re: Issues Post-Login on ISE Portal Integrated with Cisco Controller

s1nsp4wn — Tue, 30 Jul 2019 16:22:37 GMT

Thanks. A TAC rep gave me the doc below, but we determined it to be an acl issue. Also a difference in the way iphone and android send you to ports.
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-21/200565-Configure-ISE-Wireless-CWA-and-Hotspot-F.html#anc10