topic Re: Login page loop for guest Wifi - ISE-ARUBA Integration in Network Access Control

Login page loop for guest Wifi - ISE-ARUBA Integration

LPAUCISCO — Mon, 11 Mar 2019 07:29:39 GMT

I've got Aruba instant AP's using ISE for Guest authentication.

Users are authenticated successfully but it returns to login page again instead of redirection to original URL.

Radius logs shows the authentication is successful but it's not picking any authorization policy for some reason.

Hi,

Gagandeep Singh — Fri, 24 Feb 2017 04:30:00 GMT

Hi,

Seems like COA is not happening. Could you please confirm the following:

1) Send the screenshot of ACL on WLC.

2) Check if WLC is configured for COA

Security > Radius > Authentication

Check if Support for COA is enabled.

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html#anc5

Regards

Gagan

PS: rate helpful posts!!!!!

Hi Gagan,

LPAUCISCO — Fri, 24 Feb 2017 05:21:21 GMT

Hi Gagan,

COA is enable in radius definition on Aruba controller but it looks it's using port 5999 which is a bit strange.

Predefined port for Aruba device in ISE is 3799.

Screen shot attached.

To be honest, I have never

Gagandeep Singh — Fri, 24 Feb 2017 16:39:22 GMT

To be honest, I have never seen different ports on both WLC and SERVER.

If you can make it 3799 and see if that makes any difference.

Regards

Gagan

Re: Login page loop for guest Wifi - ISE-ARUBA Integration

Ruelb2214 — Tue, 14 Jun 2022 02:23:28 GMT

Hello,

I'm facing the same issue, portal page keeps looping.

Did you resolve the issue?

Please share

Re: Login page loop for guest Wifi - ISE-ARUBA Integration

bersand.mejdiovski — Tue, 20 Sep 2022 11:08:47 GMT

Hello,

I had the same problem, but I have resolved it. I used two different roles on Aruba one guest-redirect where I would redirect it to the cisco ISE portal and the other one guest-authenticated where I give internet access only and make sure that you do not enable "Download Role" on the Access tab when you create the SSID. On the Cisco ISE side also create two authorization profiles one for CWA where you would send the "Aruba-User-Role = guest-redirect" and the other one where you would send the "Aruba-User-Role = guest-authenticated. This has worked for me. I hope that will help you too.

Re: Login page loop for guest Wifi - ISE-ARUBA Integration

ahollifield — Tue, 20 Sep 2022 11:49:13 GMT

This is the way^