topic Guest Wifi portal redirection flow in Network Access Control

Guest Wifi portal redirection flow

omerfaruk — Thu, 31 Oct 2024 15:10:58 GMT

I would like to create CWA guest SSID with ISE and WLC 9800. When a client connect to the SSID, it must be redirected to guest portal automatically, which is done in my environment.

- Connect to SSID, then redirect to guest portal automatically. (bypass is disabled)

- Since I send the credentials to the clients via email, when they complete their registration, they must be able to leave guest portal and go to their email box. So, they must have an internet access. However, this internet access must be limited like 10 min. ---- (I tried to create ACL with deny 80, 443, then automatic redirect wouldn't work. When i created ACL with permit 80, 443, then clients wouldn't have internet access to check their emails.)

- The client who received the credential from his email should return to the portal and log in.

How can i setup this flow? Would it be possible if i can do the following:

When the client connects, it will go to the portal with automatic redirection and register. Here, if ISE can put a sign or a flag for the radius request and 120 seconds later, the session timeout occurs. Since there is a termination-action = radius-request, if I can add the flags to the condition in the next request and redirect them to the same portal, they can log in with the credential they received.

Re: Guest Wifi portal redirection flow

Flavio Miranda — Thu, 31 Oct 2024 16:06:07 GMT

@omerfaruk

The ACL for redirect use deny, here one example

ip access-list extended REDIRECT
 deny ip any host <ISE-IP>
 deny ip host<ISE-IP> any
 deny udp any any eq domain
 deny udp any eq domain any
 permit tcp any any eq 80

Once the client is autheticated, the ACL does not apply anymore. I recommend you to follow the guide below. Try to first make it work and then you can think how to control the access time. I am not sure what you are thinking is possible but let me take a look about possibilities

Configure Central Web Authentication (CWA) on Catalyst 9800 WLC and ISE - Cisco

Re: Guest Wifi portal redirection flow

MHM Cisco World — Thu, 31 Oct 2024 16:36:10 GMT

for email I dont sure there is away to do that automatic but manually you can use sponsor instead of portal

https://www.netprojnetworks.com/cisco-9800-with-ise-central-web-authentication/

MHM

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Fri, 01 Nov 2024 09:57:16 GMT

I think you can workaround that by enabling the "Allow guests to log in directly from the Self-Registration Success page" in the "Self-Registration Success Settings" section. Alternatively, you can rely on the grace access feature which came with ISE 2.7, however, to leverage this feature you need to enable the guests approval in the "Registration Form Settings" section. Once the guests approval is ticked, you will see a new couple boxes showing up, one is called "Allow guests to use Grace Access during sponsor's approval". If you tick the box next to that you will see that you can set the grace time in which the guest can be connected prior to any authentication.

Re: Guest Wifi portal redirection flow

omerfaruk — Fri, 01 Nov 2024 13:11:38 GMT

Thanks all for quick response.

@Aref Alsouqi, I have enabled the "Allow guests to log in directly from the Self-Registration Success page" option. This setting grants internet access to clients immediately after registration, which is what I needed. Now, clients can check their email inboxes right away.

However, after receiving their credentials from their email boxes, they should be redirected back to the portal to log in with those credentials. Could you advise on how I might configure this? If I send a Change of Authorization (CoA), will the Wi-Fi connection be briefly disconnected and reconnected, prompting the portal to reopen automatically?

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Fri, 01 Nov 2024 15:16:29 GMT

The guest users will get reauthenticated next time they are about to connect to the network. For instance, if the guest user tries to reauthenticate after their session has expired they will be prompted to provide the credentials before they are allowed access to the network. I personally don't see a use case why you would want them to be kicked off the network right after they received the email with credentials and then reauthenticate! it is kinda redundant as a task. However, if you have this requirement for any specific reason then what I think you could do is setting reauthentication timer in the common tasks in the authorization profile to be something minimum, and also to set "RADIUS:Idle-Timeout" value in the "Advanced Attributes Settings" still in authorization profile. These two values/timers would trigger the guests session to be reauthenticated, so in theory it should ask them to provide their credentials before they are allowed access to the network. Keep in mind please that it is not recommended to set small timers here, I'm not sure but I think the recommendation is not go below 4 hours or something like that. But as I said, I personally think this adds complexity to the solution and probably wouldn't give a good user experience to the guest users.

Re: Guest Wifi portal redirection flow

omerfaruk — Tue, 05 Nov 2024 16:42:42 GMT

Thank you very much Aref.

Would it be possible if ISE add a radius-attr to the WLC without affecting anything, and this attr come in the next radius request? I need to differentiate 2 radius request.

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Tue, 05 Nov 2024 18:19:45 GMT

You're welcome. I don't think that is possible because if ISE should return an attribute for a matched session that will apply to the session straightaway, it won't wait until the user/endpoint tries to reauthenticate before pushing those attributes.

Re: Guest Wifi portal redirection flow

omerfaruk — Mon, 11 Nov 2024 09:47:44 GMT

Hi,

We are using url-redirect av-pair in ISE Authorization profiles as follow. I would like to see portal id in the logs, but i couldn't. Because, WLC doesn't send it with radius request as follow. Is there a way to send portal id with radius? I am still trying to find something to differentiate the requests.

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Mon, 11 Nov 2024 10:53:02 GMT

AFAIK the session ID relates to ISE not to the WLC and you can see its reference in ISE RADIUS live logs at the very end of the page if I remember correctly.

Re: Guest Wifi portal redirection flow

omerfaruk — Wed, 13 Nov 2024 15:34:02 GMT

You are right, thanks.

ISE is currently adding registered guests to the 'Guest 24 Hours From Login' group. Would it be possible for ISE to change their group to 'Guest 4 Hours From Login' by assigning an Authorization Profile or using another method upon receiving a new RADIUS request?

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Wed, 13 Nov 2024 16:10:00 GMT

You're welcome. You can change the guest type from the guest portal settings, however, that applies to all guests, still no difference to the first time guest and the returning guest.

Re: Guest Wifi portal redirection flow

omerfaruk — Tue, 19 Nov 2024 12:10:21 GMT

Hi,

I added the following attributes from Context Visibility > Endpoints > Attributes. I want to use them in an Authorization Policy condition, but they are not available for selection. How can I use them?

Portal.Name	Self-Registered Guest Portal test
SelectedAuthorizationProfiles	WLC_CWA_login
PortalUser.CreationType	Self Registration Guest

Re: Guest Wifi portal redirection flow

Aref Alsouqi — Fri, 22 Nov 2024 11:26:17 GMT

Not sure if you can use those attributes in the authorization rules. Maybe @thomas or @Arne Bier can share some thoughts on this.

Re: Guest Wifi portal redirection flow

thomas — Fri, 22 Nov 2024 14:29:49 GMT

Endpoint Custom Attributes are simply another dictionary:attribute and should be available to use in any policy and authorization rule. See my webinar for how to configure them:

▷ User & Endpoint Custom Attributes 2022-09-06

03:09 Endpoint Profiles, Endpoint Groups versus Custom Attributes
05:01 Defining User Custom Attributes for ISE Internal Users
06:10 Defining Endpoint Custom Attributes and their Common Uses
07:36 Demo: Creating User Custom Attributes
10:41 Demo: ISE 802.1X Policy Review, and Authentication
13:51 Demo: Customize 802.1X Authorization Policy using Custom Attributes
15:20 Demo: Edit User Custom Attribute and Authenticate with Custom Attribute
16:51 Demo: Endpoint Custom Attributes
19:29 Demo: Custom Attribute Policies for IOT Endpoints
22:12 Demo: Raspberry Pi Authorizations using ISE Profiling Policies
22:36 Demo: Use Context Visibility to Edit Endpoint Custom Attributes in ISE

Re: Guest Wifi portal redirection flow

omerfaruk — Mon, 25 Nov 2024 08:58:53 GMT

Thank you Aref.

Thomas, it was an educational video with good information, thank you for your effort!

When I create custom attribute, ISE needs to be populated it. Which is I don't need. I want only use an attribute which is already in Context Visibility > Endpoints > Attributes --> Portal.Name. Unfortunately, i am not able to add it to authorization policy. There should be, but i couldn't find. Is there any suggestion?

If I create a custom attribute and dynamically assign the portal.name value to this attribute, it will also reflect the name.