topic Re: url web-redirect is not working in Network Access Control

url web-redirect is not working

apatel2489 — Mon, 05 Feb 2018 20:09:14 GMT

i have deployed ISE 2.3 and everythign works fine except client is not getting url redirect page when they open web page on browser.

is there any way that can install manually and doesn't require url redirect. i have copied and paste url from switch port and it worked and compliment but doesn't work automatically.

Thanks

Ashish

Re: url web-redirect is not working

kthiruve — Mon, 05 Feb 2018 21:01:26 GMT

It usually means that the URL-redirect ACL is not working or not correct.

1. Make sure the name of the UR-redirect ACL is the same in ISE and switch.

2. In switch the permits in ACL allows redirect, denys bypasses redirect. In WLC it is the opposite.

Please tweak these as needed and try again.

-Krishnan

Re: url web-redirect is not working

apatel2489 — Mon, 05 Feb 2018 21:20:38 GMT

Hi Krishnan,

the name of URL is correct

i have attached the pics of acl and i am not using any WLC config here just trying wired client only

Re: url web-redirect is not working

Oliver Laue — Mon, 05 Feb 2018 21:54:28 GMT

did you enabled the http and http secure-server on the switch?

Those are required on the switch for a working redirect

Re: url web-redirect is not working

apatel2489 — Mon, 05 Feb 2018 21:59:13 GMT

Yes, those are enabled and i did follow setup guide and other references

i am thinking may be firewall is blocking the packets.

the client is connected to Access switch and access switch connected to core layer 3 switch which has svi created then it is connected to Firewall which has gateway for that management svi. so not sure how i can check if firewall issue or not?

when i copy that url and paste it to client browser, it opened the page and install the anyconnect client without any issues.

Re: url web-redirect is not working

Oliver Laue — Mon, 05 Feb 2018 22:09:56 GMT

this could be your problem.

If for example you open http://google.com in your browser the switch spoofes the answer from google.com from his managemnt svi to redirect you, which will in most cases be blocked by your firewall due to anti-spoofing rules.

If im correct on iOS-XE was a change in the past to enable redirect without a L3 SVI

Re: url web-redirect is not working

Jason Kunst — Mon, 05 Feb 2018 22:13:17 GMT

AFAIK the L3 SVI needs to be on the switch the client is connected to. Not an upstream switch.

Re: url web-redirect is not working

apatel2489 — Mon, 05 Feb 2018 22:15:47 GMT

svi is on access switch but vlan is created on l3 switch and it is on asa management vlan

Re: url web-redirect is not working

gbekmezi-DD — Mon, 05 Feb 2018 23:45:41 GMT

Is there a firewall between that vlan and the client’s vlan? One quick test is to put an SVI on the switch in the same subnet as the client you are testing with. If that works, then it’s most likely a firewall. Check your firewall logs for blocks. As mentioned previously, the switch will spoof the IP address of the server the client is initiating its communication with. Most firewalls will block this. You will probably have to explicitly permit this traffic and bypass state checking for this traffic as well if there’s a firewall involved. The fir-acewall will never see the client’s syn but it will see the server’s syn-ack.

Re: url web-redirect is not working

Oliver Laue — Tue, 06 Feb 2018 06:58:43 GMT

The Switch SVI for redirects has to be in the same vlan in your Scenario to avoid the firewall from blocking the requests but it didn‘t has to be in the same Subnet, you can assign any dummy IP to the SVI since the switch is spoofing the server‘s IP.

Re: url web-redirect is not working

apatel2489 — Tue, 06 Feb 2018 14:41:22 GMT

there is a firewall between client vlan and switch management vlan and i have allow all traffic between this two vlan but it is still not able to work so please let me know if you guys have any sample configuration for firewall to bypass the traffic or any reference document ?

Re: url web-redirect is not working

Jason Kunst — Tue, 06 Feb 2018 14:45:26 GMT

Can the mgmt ip ping (reach) the clients? If not then redirect won’t work

Re: url web-redirect is not working

apatel2489 — Tue, 06 Feb 2018 14:57:40 GMT

yes, managment ip can ping the client. i can ping client ip from switch and it worked fine

Re: url web-redirect is not working

gbekmezi-DD — Tue, 06 Feb 2018 15:43:38 GMT

Pinging is not enough to validate functionality because the packets will have a spoofed source while ping has the true ip address of the switch. Additionally, the firewall will see only half the traffic when the client is being redirected.

I will repeat my recommendation that you create an SVI on the access switch in the vlan with the endpoint to validate redirect functionality. Then troubleshoot the firewall if that test is successful.

Is your firewall an ASA or FTD appliance?

Thanks

George

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

Re: url web-redirect is not working

Craig Hyps — Wed, 07 Feb 2018 04:23:39 GMT

To clarify multiple posts...

Typical config assumes local SVI as the redirect can occur locally. The redirect packet is sent from the management VLAN (or VRF) and must have an IP route to destination access VLAN network. That path may require packet to travel back upstream to L3 gateway for routing back to same switch.

It sounds like the network path may be there, but firewall blocks the one-way traffic from spoofed IP to client VLAN. As was noted, the firewall may not have access rule to permit that flow, or drop due to unexpected IP source. Firewall logs can confirm, and if packet dropped, then suggest a different resource/community to review firewall configuration.

Yes, there was a feature introduced in IOS-XE to support L2 redirect. I know there were some inconsistencies but certainly an option if running feature set that supports it.

Craig

Re: url web-redirect is not working

hslai — Fri, 09 Feb 2018 02:06:51 GMT

See ISE Traffic Redirection on the Catalyst 3750 Series Switch - Cisco

Re: url web-redirect is not working

kylerossd — Mon, 17 Dec 2018 16:09:46 GMT

Hello,

Could you please tell me the command that was introduced for the L2 redirection on IOS-XE? I am changing VLANs for guest clients there is no SVI for the guests in this network. The clients L3 interface in a firewall outside of the network.

Re: url web-redirect is not working

Jason Kunst — Mon, 17 Dec 2018 16:12:13 GMT

I would recommend you review the information in the guest guide around this

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

Re: url web-redirect is not working

Chess Norris — Wed, 13 Feb 2019 10:39:38 GMT

Does anyone know why it's necessary to enable the web server for the redirect to work? We want to use redirection in ISE for a quarantine function and be able to redirect user to a "splash page" informing them that their PC is quarantined. However, enabling the web server on the switch is raising security concerns and I am not sure why we need to enable it when we don't use the internal web server. Does it act as a proxy? Anyway to get the re-direction to work without enabling HTTP?

Edit. The following commands makes the switch not allow any sessions, so at least it will prevent unauthorized logins.

ip http secure-active-session-modules none

ip http active-session-modules none

Re: url web-redirect is not working

Jason Kunst — Wed, 13 Feb 2019 16:30:57 GMT

The switch intercepts and does the redirection to the ISE URL. You need something inline to do the redirect. ISE is not inline.

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

see Configure a Catalyst Switch for Guest Access