topic Re: Profiling based on Browser Agent in Network Access Control

Profiling based on Browser Agent

laposilaszlo — Mon, 10 Jul 2017 13:24:07 GMT

Hi,

I have created a custom login web page that is displayed when certain type of devices join the wifi network.

All works fine but the browser agent of these devices is not detected when hitting this page.

(It is detected for example when hitting the built in guest portal)

So I assume the browser agent is saved in some variable in the page code and needs to be sent somewhere internally or something else which I didnt included in my portal code.

Can someone explain what should i do for this to work?

Let me know if this is clear or additional explanation is needed.

Thanks,

laszlo

Re: Profiling based on Browser Agent

hslai — Mon, 10 Jul 2017 21:11:44 GMT

I believe your custom login web page is external to ISE and not considered as one of ISE guest web portals.

The ISE web portals are internal to ISE and they have intel on the MAC address along with the User-Agent string so they are able to add the attribute for the endpoints.

For external web access, we rely on HTTP probe and the web access needs to be in clear (non-HTTPS).

Re: Profiling based on Browser Agent

laposilaszlo — Tue, 11 Jul 2017 06:56:24 GMT

Hi,

In our case HTTP profiling is not enabled.

But i made some test in the lab, same setup with HTTP profiling enabled and still user agent is not detected.

So for example a client joins and in the browser the custom external webpage is shown.

But in ISE this endpoint is shown to be profiled using radius profile and the decision was made based on MAC oui.

No browser agent is detected.

Any other ideas?

Thanks,

Laszlo

Re: Profiling based on Browser Agent

Timothy Abbott — Tue, 11 Jul 2017 14:08:53 GMT

You won't get the user-agent from the endpoint unless it is redirected to a portal hosted on ISE or you use Device Sensor on the WLC with HTTP profiling enabled for the SSID. ISE will profile the endpoint to the extent that is has information sent to it like the MAC address, etc.

Regards,

-Tim