topic Re: Cisco ISE Guest Portal Access in Network Access Control

Cisco ISE Guest Portal Access

mikiNet — Wed, 07 Dec 2022 15:19:42 GMT

Hello,

I have ISE 3.1 with patch4 installed. I implement Guest Portal access for guests who visiting our company. Guest Portal is manage by Sponsors - They must create password and give it to Guest, then Guest has access to network (only Internet). Everythink working good but after 10 minute Guest report me that connection is termination. This situation happen always, after 10 min guest is logout out from guest network... I don't see any configuration with set time to 10min...

Any idea ? Where is problem ?

Re: Cisco ISE Guest Portal Access

balaji.bandi — Wed, 07 Dec 2022 17:08:49 GMT

chcek on ISE Logs what is the reason of termination connection, where that is coming from user ? Wireless ?

Re: Cisco ISE Guest Portal Access

Ambuj M — Wed, 07 Dec 2022 17:14:13 GMT

Agree with Balaji, considering time of 10 minutes, by default DCA runs every 10 minutes if not set properly, so you might want to check that also, I had similar issue with a customer once where users will disconnect every 10 minutes.

is this happening with just guest or all SSIDs ? is it happening with all guest or some guests only ?

Re: Cisco ISE Guest Portal Access

mikiNet — Wed, 07 Dec 2022 18:33:18 GMT

Yes, this happening with just guest user - only on this SSID and it happen with all guest - how you set DCA to work properly ?

Cisco ISE Live logs not showing any problem, I only see REDIRECTION to CWA portal and Permit Access. That's all.

Re: Cisco ISE Guest Portal Access

balaji.bandi — Wed, 07 Dec 2022 19:22:25 GMT

I am sure ISE get logs what is the reason of termination connection.

not sure what WLC controller below config give example : DCA :

https://mrncciew.com/2013/03/16/configuring-dca/

also check session timeout in WLAN Advanced config, anything changed :

Other options create a test environment and run debug see the reason of disconnection.

Re: Cisco ISE Guest Portal Access

hslai — Sat, 10 Dec 2022 20:34:50 GMT

@mikiNet Once a guest device completes authentication and authorized to access Internet, ISE is not really involved unless any CoA or accounting events. I would suggest debugging on the WLC with some command like (if Cisco 9800-WLC)

debug wireless mac <>

Or, similar.

Re: Cisco ISE Guest Portal Access

mikiNet — Mon, 12 Dec 2022 10:50:06 GMT

Ok, I have a solution. I disable this option on WLC:

Uncheck "Enable Session Timeout" - then all works good.

Re: Cisco ISE Guest Portal Access

balaji.bandi — Mon, 12 Dec 2022 17:15:51 GMT

Glad you able to fix the issue, that was my suggestion before.