topic Re: Problem with sponsor portal on Cisco ISE in Network Access Control

Problem with sponsor portal on Cisco ISE

lnw-team — Mon, 15 Apr 2024 13:30:05 GMT

Hello,

We are experiencing issues with guest access in one of our APAC locations. People who are trying to connect to "guest" SSID are getting IP address from the correct VLAN and sponsor portal is displayd properly. However, after typing their login credentials, although they get message saying that from now on they have internet access, when they try to access any website sponsor portal appears again and authentication process starts from the beginning. I've checked policy configuration on Cisco ISE and it's the same as in other sites. What's more, we can clearly see on the firewall that there's an internet traffic from the guest host to the internet and in the opposite direction. Nothing is being blocked. Any ideas?

Re: Problem with sponsor portal on Cisco ISE

Aref Alsouqi — Mon, 15 Apr 2024 13:39:46 GMT

It does seem that the order of the authorization rules in ISE might not be correct and as if the guest users hit the redirection rule again instead of hitting the guest flow allow rule. Also, please check the CoA is enabled as it would be needed in this case.

Re: Problem with sponsor portal on Cisco ISE

lnw-team — Mon, 15 Apr 2024 14:06:43 GMT

Authorization rules are correct. The same rules are configured for the other region.

Re: Problem with sponsor portal on Cisco ISE

MHM Cisco World — Mon, 15 Apr 2024 15:47:15 GMT

First point to check is check live log

Check authc authz and policy set for cleint' are it correct or not?

MHM

Re: Problem with sponsor portal on Cisco ISE

Aref Alsouqi — Mon, 15 Apr 2024 16:29:38 GMT

Is CoA enabled on the WLC? if so, I would raise this with TAC.