topic Re: Custom error messages in guest / CWA portal in Network Access Control

Custom error messages in guest / CWA portal

blandrum — Fri, 08 Feb 2019 16:39:33 GMT

I have a need to return custom error messages to a user when they fail to pass through a CWA portal.

For instance, a user signs in and passes authentication, but doesn't have the proper AD group membership. Want error message to state "you're missing XXXX access".

Re: Custom error messages in guest / CWA portal

Jason Kunst — Fri, 08 Feb 2019 17:33:44 GMT

You would need to direct them to a custom page built under customer portal files
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010000.html#id_34829

if guest_flow and ADgroupX then redirect to authz profile with custom file redirect

Other customization examples under http://cs.co/ise-guest

There is no way dynamically to do this in the portal.

Re: Custom error messages in guest / CWA portal

blandrum — Wed, 20 Feb 2019 15:32:02 GMT

I'm not sure how ISE will be able to detect the group membership of the user, since this is purely a MAB+CWA authentication. I'm going to play around in the lab today with it, but are you suggesting they'll hit a "default" portal, which will then dump the user into the guest_flow, re-parse the authz list, then redirect them to a second portal based on their group membership?

Re: Custom error messages in guest / CWA portal

Jason Kunst — Thu, 21 Feb 2019 12:42:52 GMT

the only way to know the group is to have them login to the CWA portal and get a success then you can now key off that since a COA took place authz will know the info. You can say say if guest_flow and AD group.
take a look at the http://cs.co/ise-guest
ISE Guest Access Prescriptive Deployment Guide