topic Re: Support for VRF Aware HTTP Redirection for Guest/CPP in Network Access Control

Support for VRF Aware HTTP Redirection for Guest/CPP

jupoole — Tue, 30 May 2017 16:38:41 GMT

Hello,

Trying to get Guest/CPP redirection working on a 3850 running 03.07.05.E. My .1x client VLAN is using a VRF and I can access the URL if I manually enter the redirect URL, I just cant get it to automatically redirect. I came across this from a previous discussion:

https://supportforums.cisco.com/discussion/12751816/guest-separate-vrf-support-http-redirection-switch-vrf#comment-12098…

Seems like a known issue but even upgrading to 3.7.5 didn't resolve the issue. Anyone else seen this?

Re: Support for VRF Aware HTTP Redirection for Guest/CPP

hariholla — Tue, 30 May 2017 17:32:08 GMT

The VRF aware URL redirection is fixed from 3.7(2)E via CSCuu28069

You need to have IBNS 2.0 configuration on the switch and the following commands are necessary:

parameter-map type webauth global

webauth-vrf-enabled

Hope this helps,

-Hari

Re: Support for VRF Aware HTTP Redirection for Guest/CPP

jupoole — Tue, 30 May 2017 17:59:36 GMT

The document you included doesn’t mention anything about the VRF config. Please advise.

Re: Support for VRF Aware HTTP Redirection for Guest/CPP

Craig Hyps — Tue, 30 May 2017 18:11:18 GMT

Related bugids but they all point to same requirement to allow for a local redirection without reliance on global routing table...

CSCsz61106 WebAuth fails to function correctly with VRF-based VLANS 

CSCuq77696 ISE in a VRF - managed Services environment

CSCug97543 WebAuth fails to function correctly with VRF-based VLANS.

/Craig

Re: Support for VRF Aware HTTP Redirection for Guest/CPP

hariholla — Tue, 30 May 2017 19:10:02 GMT

At the time when that document was written, this issue wasn't resolved. You need the combination of the config in that document plus the two commands I have specified above for this to work. We will work on a composite guide some time in the near future.

Cheers!

-Hari