topic Re: Walled garden and Web redirection in Network Access Control

Walled garden and Web redirection

Chess Norris — Tue, 05 Mar 2019 14:54:56 GMT

I am currently working on a Rapid Threat Containment project involving Firepower and ISE to force an infected client to use a different authorization policy with limited access. We then want to redirect a quarantined user to an external web server that can inform the user about the situation. In order to get the redirection to work, we need to enable the http/https server on the switch and this has raised some security concerned. We could prevent management of the switch by using the commands "ip http active-session-modules none" and "ip http secure-active-session-modules none", but that will still leave the ports open and I am looking for an alternative solution to get redirection to work. I have heard about the "walled garden" concept with fake DNS responses and wondering if this could be an alternative? Does anyone have experience with using walled garden for web redirection or know of any other solutions to do redirection without enabling the web server on the switch?

Thanks

/Jörgen

Re: Walled garden and Web redirection

howon — Wed, 13 Mar 2019 21:10:36 GMT

Yes, you can use Auth VLAN feature but in general we recommend using switch's ability to redirect instead for Catalyst devices. Also note that AnyConnect 4.4+ can discover PSN without using URL-redirect so posture can be supported without it. However, you cannot redirect regular web traffic for non AnyConnect posture use cases.

Re: Walled garden and Web redirection

Chess Norris — Tue, 14 May 2019 07:33:45 GMT

Thank you. Do you know any configuration examples for how to configure Auth VLAN web redirection?

Best regards

/Jorgen

Re: Walled garden and Web redirection

Jason Kunst — Tue, 14 May 2019 14:59:10 GMT

Some examples
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01001.html#concept_CDD87F6FE3A54351B27FF35316A23DA3
https://community.cisco.com/t5/security-documents/ise-2-1-integration-with-ruckus-1200-wireless-byod-posture-using/ta-p/3640842

Re: Walled garden and Web redirection

Chess Norris — Wed, 15 May 2019 14:39:44 GMT

Thank you both for the help