topic Re: Guest Device Compliance Settings - Missing in Network Access Control

Guest Device Compliance Settings - Missing

creserva1 — Sat, 09 Jun 2018 16:44:07 GMT

I am getting this Java requirements after login using CWA. It says on https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011…

I also found this similar issues Problem with portal guest Cisco ISE

It is missing on my guest portal. I am using 2.3.0.298

Re: Guest Device Compliance Settings - Missing

Craig Hyps — Tue, 12 Jun 2018 00:48:24 GMT

Verify portal is a sponsor or self-reg portal (not Hotspot). I can think of a few settings that may trigger including Web Agent and DHCP renewal applet...

Re: Guest Device Compliance Settings - Missing

creserva1 — Wed, 13 Jun 2018 22:09:31 GMT

Opened case with cisco and yes it was that settings "Enable VLAN DHCP release". Thanks

Re: Guest Device Compliance Settings - Missing

Damien Miller — Wed, 13 Jun 2018 22:39:14 GMT

I would say that it's not recommended to use ip release /renew feature on the guest portals. The support for this has faded from browsers.

This relies on Java and the only browser I know that currently supports this is internet explorer. If a guest uses Chrome, Firefox, or safari, then they will have problems.

I worked with tac recently and filed a new bug in 2.4 because this feature is not working anymore. Something has changed and the coa/vlan change is not applying after the first guest login. You log in a second time and the vlan change applies.

Re: Guest Device Compliance Settings - Missing

Craig Hyps — Wed, 13 Jun 2018 23:54:34 GMT

Agree this option is not generally recommended. Question was more specific to Java warning and what may have triggered it. For reasons cited, it would be better to avoid any VLAN change for web auth flow (no supplicant to detect VLAN change). For wireless it may be possible to assign a new interface which shares same IP address space, or use ACLs or SGTs to apply different traffic policy without flipping VLANs/subnets.

Re: Guest Device Compliance Settings - Missing

creserva1 — Thu, 14 Jun 2018 12:53:40 GMT

Actually I had this turned on "Enable VLAN DHCP release" and the solutions was to turn it off. I must have been playing with settings and forgot to revert it back to default which is off by default..