topic Missing NetworkAccess UseCase in ISE 2.3 in Network Access Control

Missing NetworkAccess UseCase in ISE 2.3

rovargas — Mon, 07 Aug 2017 09:20:06 GMT

I used to use "Network Access:UseCase EQUALS Guest Flow" as the selection criteria to choose Captive Portal authentication in the Policy section. With ISE 2.3 I see no UseCase option anymore...

Is this a expected behaviour? What is the best alternative?

Regards

Roman

Re: Missing NetworkAccess UseCase in ISE 2.3

Craig Hyps — Mon, 07 Aug 2017 11:09:40 GMT

Make sure you remove any dictionary filters (no icon selected in library) to display all attributes. You can then enter keywords to find network access attributes.

Re: Missing NetworkAccess UseCase in ISE 2.3

smashash — Mon, 07 Aug 2017 11:27:00 GMT

is that post upgrade?

try to use the 'Editor' to find the attribute.

Re: Missing NetworkAccess UseCase in ISE 2.3

rovargas — Mon, 07 Aug 2017 17:08:08 GMT

It is a fresh install of the FCS code.

I see no UseCase option (with no filters). In fact the only options available are the ones bellow...

Re: Missing NetworkAccess UseCase in ISE 2.3

hslai — Mon, 07 Aug 2017 17:17:11 GMT

Your screenshot looks like from the conditions studio for authentication policy rules. If that is the case, it's expected not having NA.UseCase, as such attribute will not work correctly during authentication evaluation.

Re: Missing NetworkAccess UseCase in ISE 2.3

rovargas — Mon, 07 Aug 2017 17:41:12 GMT

In fact, my intention is to use "Network Access:UseCase EQUALS Guest Flow" as the selection criteria to choose Captive Portal authentication in the Policy section, as I have been doing from the first ISE version that supported Policy Sets many years ago...

ISE 2.3 (where I cannot use "Network Access:UseCase EQUALS Guest Flow"):

ISE 2.2 (and previous) were I could use "Network Access:UseCase EQUALS Guest Flow"):

Any other alternative?

Thanks

Re: Missing NetworkAccess UseCase in ISE 2.3

hslai — Mon, 07 Aug 2017 18:36:59 GMT

The attribute has been removed as a fix for CSCvc98033 and ISE 2.3 is the only shipping release with this fix.

It's not common to use such attributes for authentications as they would only work for re-auth of an existing session and their existence causes confusion to customers.

I do not see any workaround other than for you to re-design the policy sets and moving that inside of an policy set and under authorization.

Re: Missing NetworkAccess UseCase in ISE 2.3

gbekmezi-DD — Mon, 07 Aug 2017 19:17:09 GMT

I agree with Hsing. The session is not considered a guest flow until after authentication. This means you would have the same session using two different policy sets. This document has a good description for how that use case is intended to be used: https://supportforums.cisco.com/document/110031/central-web-authentication-cwa-guests-ise This is another page with a similar description: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200273-Configure-ISE-Guest-Temporary-and-Perman.html

Re: Missing NetworkAccess UseCase in ISE 2.3

Craig Hyps — Mon, 07 Aug 2017 20:26:09 GMT

Correct. I did not catch earlier from mobile device that intent was to use this at Policy Set level. USE_CASE GuestFlow is primarily to match authorization condition, i.e. there is a reauthorization situation where user has just completed successful web auth event. It may have worked in prior model but that was not purpose and need to keep the policy set level for things that are accessible at a higher level in RADIUS conversation.

Craig

Re: Missing NetworkAccess UseCase in ISE 2.3

Marvin Rhoads — Fri, 25 Aug 2017 05:44:44 GMT

Along the topic of this thread, am I correct in understanding that "Guest Flow" attribute is set for the RADIUS session when ISE detects the endpoint (ie the user on the endpoint) has authenticated via the CWA portal?

So on first access, user is redirected. They authenticate and then the flag is set and a CoA issued for that session. Upon re-authorization the flag is detected and appropriate access is granted.

Re: Missing NetworkAccess UseCase in ISE 2.3

Craig Hyps — Fri, 25 Aug 2017 08:28:20 GMT

Essentially that is correct.

Re: Missing NetworkAccess UseCase in ISE 2.3

JustTakeTheFirstStep — Thu, 19 Dec 2019 04:04:37 GMT

I faced the same problem.

How did you solve this?