topic Re: Two redirection URLs are being pushed in Network Access Control

Two redirection URLs are being pushed

dgaikwad — Fri, 20 Mar 2020 14:19:37 GMT

Setup is ISE 2.6.0.156
Switch 2960 Lanbase IOS 15.0(2)SE11
Windows 10
AnyConnect version 4.7.04056

While testing I saw that there are two different redirection URLs being pushed, I see the same thing in live logs and on the authentication session that is applied for the endpoint.
Is this something that is new or am I missing some configuration here.

The policy set at this time is pretty simple, posture status = unknown, redirect to CPP
With the ACL on switch as follows:

deny udp any any eq domain

deny udp any eq bootpc any eq bootps
deny udp any eq bootps any eq bootpc
deny tcp any host <ISE Server IP address> eq 8443
deny tcp any host <ISE Server IP address> eq 8905
deny udp any host <ISE Server IP address> eq 8905
permit tcp any any eq www
permit tcp any any eq 443

Re: Two redirection URLs are being pushed

Colby LeMaire — Fri, 20 Mar 2020 18:37:08 GMT

I personally have not seen this behavior before and I have done countless ISE deployments. I am curious if it is actually sending both URL's in the Radius Access-Accept or if it is just a cosmetic bug in the GUI. Can you do a tcpdump on the PSN and take a look at the Radius packets? But either way, this looks like a bug. I would recommend opening a TAC case.

Re: Two redirection URLs are being pushed

Cristian Matei — Sat, 21 Mar 2020 06:59:24 GMT

Hi,

I've seen this happening couple of times, it was always an ISE bug, for example, see attached. Apply the latest patch and if behaviour is still there, upgrade to a newer recommended release, like ISE 2.6.0 patch 5.

Regards,

Cristian Matei.

Re: Two redirection URLs are being pushed

hslai — Mon, 23 Mar 2020 20:24:09 GMT

CSCvp77017 is duplicate to CSCvj05563, which addressed in ISE 2.6 Patch 1.

Re: Two redirection URLs are being pushed

dgaikwad — Wed, 01 Apr 2020 17:50:08 GMT

WIll have to work with the customer on this and post an update once its done.
Thanks for the pointer.