topic Re: ISE Guest Redirection Everytime in Network Access Control

ISE Guest Redirection Everytime

NETAD — Mon, 06 May 2019 16:50:46 GMT

Hello, I'm currently redirecting the guest users to a hotspot portal and that's working just fine. Once they disconnect and attempt to re-connect they're not being redirected to the portal anymore. How can I configure ISE to redirect the guest users everytime they connect to the guest wireless. I guess what I'm asking is if there's a way to purge the guest account automatically everytime they disconnect from the wireless.

Re: ISE Guest Redirection Everytime

howon — Mon, 06 May 2019 17:29:50 GMT

Closest option is to use 'Endpoints: LastAUPAcceptanceHourse' condition to force them to accept AUP at set interval.

Re: ISE Guest Redirection Everytime

NETAD — Mon, 06 May 2019 17:46:00 GMT

Thanks Howon, what's the minimum that can be set. We're on 2.4 latest patch. Also do I have have to synch that timeout with the session timeout on the WLC?

Re: ISE Guest Redirection Everytime

Aravind Ravichandran — Tue, 07 May 2019 11:51:33 GMT

Is it possible to share the policy screenshot?

Re: ISE Guest Redirection Everytime

NETAD — Tue, 07 May 2019 13:20:28 GMT

Here it is. I just not sure what value I should be configuring to redirect the wireless user to the portal everytime they connect to the wireless even if they connect back to back.

Re: ISE Guest Redirection Everytime

Aravind Ravichandran — Tue, 07 May 2019 14:08:19 GMT

1. Redirection policy with conditions as wireless mab & SSID name -> redirects to the guest portal.

2. Guest access policy with the condition as Network access: UseCase equals to Guest Flow -> Guest Access

Similar to this one.Guest policy-redirects at every reconnection

Re: ISE Guest Redirection Everytime

Jason Kunst — Tue, 07 May 2019 14:24:54 GMT

See this section of the guide
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#task_B11E9389EBF24FFF98ED40C1501F6E8B

Re: ISE Guest Redirection Everytime

NETAD — Tue, 07 May 2019 14:31:22 GMT

Thanks Jason, so the period can't be less than 24 hours? I went through this doc and it says I can set the minimum to be 1 hour.

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/TECSEC-3672.pdf

Will my authz policy work the way it's created to prompt the guest for the AUP if they haven't accepted it in the last hour?

Re: ISE Guest Redirection Everytime

Jason Kunst — Tue, 07 May 2019 15:07:31 GMT

@NETAD wrote:

Thanks Jason, so the period can't be less than 24 hours? I went through this doc and it says I can set the minimum to be 1 hour.

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/TECSEC-3672.pdf

Will my authz policy work the way it's created to prompt the guest for the AUP if they haven't accepted it in the last hour?

Its showcasing a time range, saying < 24 hrs then dont prompt. The minimum time is 1 hour. The admin guide needs to be fixed. Why are you wanting to accept every time, this is going to be awful for user everytime they sleep their mobile device..

Re: ISE Guest Redirection Everytime

hslai — Sun, 12 May 2019 00:31:54 GMT

Another way might be to use the regular guest portal with username and password, rather than hotspot. I believe there a way to pre-filll the credentials, if needed.

Also, if CoA Reauthenticate selected as the CoA type in a hotspot portal, we might be able to use some attributes, such as GuestFlow as proposed by Aravind Ravichandran, to authorize the endpoints with proper access.

Re: ISE Guest Redirection Everytime

NETAD — Tue, 14 May 2019 16:09:21 GMT

I ended up creating a purging policy that purges endpoints every 8 hours which is the minimum. This is working fine. Thanks for all your inputs.