topic Cisco ISE CWA Guest Access with Sponsor Portal in Network Access Control

Cisco ISE CWA Guest Access with Sponsor Portal

mikiNet — Sun, 31 May 2020 14:54:27 GMT

Dear Collegues,

I experiencing very strange situation. First of all, I have 2xISE 2.6 in HA:

I implemented Guest Portal with Sponsor Portal where, Sponsors create account for guest, then guest has limited access to network. Everything working good only where:

1. In Authorization profile I use static IP mapping for one PSN or FQDN of Guest Portal (where DNS server has only one record A mapping to PSN)

Please be aware that above screenshot is from official cisco documentation. In my scenerio I have set value: Guest Portal (not Self-Registered Portal)

2. In WLC I have set only one Radius Auth/Acc:

For above configuration (Rest of all configuration I skip because it has not impact for my problem) as I said everything workig good.

Problem appear where:

I set in WLC for section AAA Server second PSN and where I set second PSN address IP (record A in DNS Server) for FQDN Guest Portal.

I think that problem is related with SessionID when ISE transfer authorization profile to guest.

Guest send request to DNS, and DNS return other IP address of PSN which transfer authorization profile before. So guest trying to reach Guest Portal on PSN which not know about this session.

How can I resolve the problem ?

Is it possible to configure Guest Portal where I have 2 PSN ? Or I need LB (for example F5) ?

Re: Cisco ISE CWA Guest Access with Sponsor Portal

Rob Ingram — Sun, 31 May 2020 16:21:26 GMT

Hi,
You need to associate the Guest portal with the PSN that authenticated the session, normally in this situation a load balancer would be recommended. You can achieve this without a LB by creating multiple authorisation profiles/rules for each PSN.

- Create 2 Guest FQDNs for each PSN
- Create 2 authorisation profiles, in the frist profile reference the PSN1 FQDN and in the other reference the PSN2 FQDN
- Create 2 authoration rules, match on condition "Network Access ISE Host Name EQUALS <PSN1>" and reference the PSN1 authorisation profile. Create a second authorisation rule, match on condition match on condition "Network Access ISE Host Name EQUALS <PSN2>" and reference the PSN2 authorisation profile.

HTH

Re: Cisco ISE CWA Guest Access with Sponsor Portal

mikiNet — Sun, 31 May 2020 18:39:23 GMT

Thanks Rob!! About "Create 2 Guest FQDNs for each PSN" - is it related to create two Guest Portal ? Additionaly, if I must create two DNS record A ? One for PSN1 and other to PSN2 ?