topic Re: Redirection URL missing in Network Access Control

Redirection URL missing

dgaikwad — Wed, 27 Jun 2018 11:40:55 GMT

Hi Experts,

While configuring for wired guest redirection using the sponsor guest portal, I have seen something weird that is happening here.

When I have the user redirect from a test switch to the Test ISE server, the redirection URL is working and can be seen on switch as well as the Test endpoint browser.

Then I, make the same to same configuration on our Production server, but there is no redirection URL!!

I have the same guest redirect ACL in test and production ISE instances.

Also, the AuthZ profiles and Policy and conditions are same as well.

Not sure what is going on?

Could any shed some light on this issue, and what are the things that could be missing out?

Any pointers are really helpful.

Re: Redirection URL missing

ognyan.totev — Wed, 27 Jun 2018 12:06:03 GMT

Firewall between deployment switch and ISE ??

Blocked port 1812,1813 ,1645,1646

Re: Redirection URL missing

Jason Kunst — Wed, 27 Jun 2018 12:14:33 GMT

Would suggest trying a new portal on your production

Use the tac to debug

Re: Redirection URL missing

Jason Kunst — Wed, 27 Jun 2018 12:16:57 GMT

Also try different browser

Re: Redirection URL missing

Craig Hyps — Wed, 27 Jun 2018 12:47:48 GMT

Make sure hitting the right policy rule and authorization profile -- check live log entry -- should see URL redirect.
Make sure URL redirect ACL configured on production switch. For wireless, only need redirect ACL. For wired, need to include the dACL as well. Redirect ACL logic is different between wired and wireless in terms of what is denied and permitted.
Make sure client has IP address, else cannot redirect. For wired, dACL cannot be instantiated on port.
Make sure host/subnet entries are correct for production.

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 06:25:50 GMT

I have rechecked the configuration and all the things are in the right place.

There is a redirect ACL on the switch, and as off now I have only included only one PSN in the ACL.

I can see that the its hitting the right policy and condition, but even then I am not able to see any redirection URL on the switch.

The user is then presented with the guest login page, he enters the credentials, but then authentication fails and there is no access..

This is happening even when the user is present...

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 06:26:35 GMT

Yes, these ports are open and I can see that the request is hitting the right policy and condition on ISE server.

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 06:28:26 GMT

Tried with a completely new portal, yet I don't see the redirect URL on the switch where as on ISE I can see that its hitting the right policy and condition.

Also, the user is able to see the guest login page on his endpoint, but his authentication fails, even when the user is present in the guest users...

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 10:09:00 GMT

While further troubleshooting found that the redirection URL was being sent. but it was being sent by another switch.

User was able to authenticate and was able to gain access normally it would do.

So the question is that, if this switch is in open mode, in that case...

if the port 1812 and 1813 are not open between ISE and switch, will another switch that has ports open between ISE process the request?

Is this something strange or has been faced earlier as well?

Re: Redirection URL missing

Craig Hyps — Thu, 28 Jun 2018 10:19:10 GMT

Not clear what is meant by "sent by another switch". The redirection is originated by ISE, not the switch. Once redirect authorization applied to the access device, the user is redirected by the wireless controller or wired switch to which it is connected. The only way I see that happening is if you are hanging additional hubs/switches off an authenticating switch port.

You will see in RADIUS Live Logs the switch IP (Device IP and NAS-IP-Address) of the authenticating network access device. Authorization will be sent to that switch only. The URL redirect should be seen on connected switchport using the "sh auth session interface <x> detail" command (or similar command depending on model/version).

Re: Redirection URL missing

ognyan.totev — Thu, 28 Jun 2018 10:19:54 GMT

I think the answer is NO ,endpoint is connected to the 1 switch no mater if there are any other switches ,the request will be send exact form this switch and the answer must be on same switch on same port that endpoint is . Give us some configuration on the switch my opinion is NO.

Re: Redirection URL missing

Jason Kunst — Thu, 28 Jun 2018 11:18:39 GMT

I could see where 2 different switches are running and svi for same vlan perhaps and traffic is being proxied perhaps by another switch?

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 11:24:08 GMT

Here is the snippet of the configuration on the switch:

aaa new-model

aaa group server radius POC_ISE

server <Test ISE Server> auth-port 1812 acct-port 1813

aaa group server radius PROD_ISE

server <Prod PSN Server> auth-port 1812 acct-port 1813

aaa authentication login default local

aaa authentication dot1x default group PROD_ISE

aaa authorization exec default local

aaa authorization commands 15 default local

aaa authorization network default group PROD_ISE

aaa accounting dot1x default start-stop group PROD_ISE

aaa server radius dynamic-author

client <Test ISE Server> server-key 7 01100F175804575D72

client <Prod PSN Server> server-key 7 0802455D0A1625464058

interface FastEthernet1/0/3

switchport access vlan 230

switchport mode access

switchport voice vlan 260

authentication event server dead action authorize vlan 231

authentication event server dead action authorize voice

authentication event server alive action reinitialize

authentication host-mode multi-domain

authentication open

authentication order mab dot1x

authentication priority dot1x mab

authentication port-control auto

mab

dot1x pae authenticator

dot1x timeout tx-period 10

spanning-tree portfast

ip access-list extended GUEST_REDIRECT

deny udp any any eq domain

deny udp any eq bootps any eq bootpc

deny udp any eq bootpc any eq bootps

deny ip any host <Prod PSN Server>

permit tcp any any eq www

permit tcp any any eq 443

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 25 access-request include

radius-server dead-criteria time 5 tries 2

radius-server host <Test ISE Server> auth-port 1812 acct-port 1813 key 7 1511021F07257A767B

radius-server host <Prod PSNr> auth-port 1812 acct-port 1813 key 7 062506324F4129485744

radius-server deadtime 10

radius-server vsa send accounting

radius-server vsa send authentication

Output when the switch is pointed to the production PSN:

NAC-3750v1#show authentication sessions interface fastEthernet 1/0/3

Interface: FastEthernet1/0/3

MAC Address: 54e1.ad5d.194a

IP Address: 10.226.242.13

User-Name: 54e1ad5d194a

Status: Authz Success

Domain: DATA

Security Policy: Should Secure

Security Status: Unsecure

Oper host mode: multi-host

Oper control dir: both

Authorized By: Critical Auth

Vlan Policy: 231

Session timeout: N/A

Idle timeout: N/A

Common Session ID: 0AE2E8190000008A0E9F12A9

Acct Session ID: 0x000000A4

Handle: 0x3D00008A

Runnable methods list:

Method State

mab Authc Failed

dot1x Not run

Critical Authorization is in effect for domain(s) DATA and VOICE

Let me what else is needed.

Re: Redirection URL missing

ognyan.totev — Thu, 28 Jun 2018 11:26:00 GMT

Ok lets say same SVI interface but this interface must have different IP address . 1 switch 1 ip address

and other 2 ip address on svi

In mine deployment most of switches are on same SVI example interface VLan 570 but all are have different

but all of them different IP address. And i never face this. ANd according to netowrok i dont think it is possible

Re: Redirection URL missing

ognyan.totev — Thu, 28 Jun 2018 11:37:37 GMT

show authentication sessions interface fastEthernet 1/0/3 details please

And screen shot from radius live logs

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 11:58:20 GMT

Here is the output for Auth sessions:

NAC-3750v1#sh auth sess int fa1/0/3

Interface: FastEthernet1/0/3

MAC Address: 54e1.ad5d.194a

IP Address: 10.226.242.13

User-Name: 54e1ad5d194a

Status: Authz Success

Domain: DATA

Security Policy: Should Secure

Security Status: Unsecure

Oper host mode: multi-host

Oper control dir: both

Authorized By: Critical Auth

Vlan Policy: 231

Session timeout: N/A

Idle timeout: N/A

Common Session ID: 0AE2E8190000008B0F0373F3

Acct Session ID: 0x000000A6

Handle: 0x1400008B

Runnable methods list:

Method State

mab Authc Failed

dot1x Not run

Critical Authorization is in effect for domain(s) DATA and VOICE

Live logs:

What exactly is needed from ilve logs?

Re: Redirection URL missing

Craig Hyps — Thu, 28 Jun 2018 13:49:35 GMT

You need to get past failed AAA auth/server...

Runnable methods list:

Method State

mab Authc Failed

dot1x Not run

Critical Authorization is in effect for domain(s) DATA and VOICE

Re: Redirection URL missing

dgaikwad — Thu, 28 Jun 2018 14:13:18 GMT

I am seeing this failed auth server when I am pointing it to the Prod ISE, not when I point it to test ISE server...

Is this due to two servers specifiedin the dynamic author command?

Re: Redirection URL missing

gbekmezi-DD — Thu, 28 Jun 2018 16:25:37 GMT

Authorized By: Critical Auth

Critical Auth kicks in when the switch can’t communicate to the radius server. It’s probably a firewall issue. As far as the redirect being on another switch, it’s possible that happens if you have a switch upstream that is doing multi-auth on the downlink port…then than switch could possibly be sending an authc request to ISE for the same endpoint via MAB. I don’t recommend this design if you have it configured that way.

George

Re: Redirection URL missing

dgaikwad — Mon, 02 Jul 2018 08:03:08 GMT

Hi all,

In the end it turned out that, the guy who had configured the policies and ACL for the prod has also created a specific dACL for the closed mode.

After applying the dACL for closed mode on the AuthZ profile, was to see the redirect URL on the switch as well.