topic Re: ISE CWA URL Redirection for https in Network Access Control

ISE CWA URL Redirection for https

tolarosa@cisco.com — Tue, 13 Mar 2018 18:55:37 GMT

Hi All,

I'm running into some issues with CWA URL Redirection to work with https sessions. We try to browse to a https websites (google, etc) and CWA URL Redirection doesn't work. Works great with http websites. Is there a workaround or a solution for this type of situation?

Thanks,

-Tony

Re: ISE CWA URL Redirection for https

#Mat — Tue, 13 Mar 2018 21:33:48 GMT

Hi Tony. You have to enable it: "config network web-auth https-redirect enable"

In these links, you will find the full information.

Understanding HTTPS Redirect over Web-a... - Cisco Support Community

Configure HTTPS Redirect over Web-auth - Cisco

I hope you find it useful.

Regards.-

Re: ISE CWA URL Redirection for https

tolarosa@cisco.com — Wed, 14 Mar 2018 12:31:48 GMT

Thanks Matias, however I should have mentioned this is CWA on a switch wired network, not WLC. I have the following ip http and ACL configured:

ip http server

ip http secure-server

ip http secure-active-session-modules none

ip http active-session-modules none

ip access-list extended ACL_WEBAUTH_REDIRECT

permit tcp any any eq www

permit tcp any any eq 443

deny ip any any

-Tony

Re: ISE CWA URL Redirection for https

Craig Hyps — Wed, 14 Mar 2018 13:15:42 GMT

Likely issue is that the client browser is not trusting the cert from switch. In the process of redirection, then switch must respond directly to the HTTPS request and attempt redirect. Since the certificate does not match expected for target site, such as Google.com, the browser will likely produce an error. Depending on browser version and config, it may simply allow you to continue, but as browsers lock down untrusted content, it may not allow user to proceed at all. Some mobile clients handle captive portals by sending out discovery packets on http to auto-open a mini-browser for auth. On wired, you will likely not see this yet. Although not ideal, one option is to have users set their home page to company's internal landing page, or to have guests/contractors open page to the internal company page.

Re: ISE CWA URL Redirection for https

paul — Thu, 15 Mar 2018 13:43:10 GMT

If you are testing with Chrome going to Google your ACL probably wouldn't work as Chrome will default to using QUIC protocol (UDP/443) and your ACL doesn't intercept that and the switch would have no chance of redirecting a proprietary protocol. Do you have a DACL applied as well to block traffic?

I am assuming you have tried other SSL web sites in browsers other than Chrome and they don't redirect either.