topic Re: No redirection to ISE Posture Portal in Network Access Control

No redirection to ISE Posture Portal

Monsinka — Thu, 31 Oct 2024 13:44:48 GMT

Dear community,

I'm configuring the Posture with client provisioning. when the user tries to connect to the network, he is successfully authenticated, but he is not being redirected to redirect URL. when i try to manually enter the URL on different browsers i get the portal to download the anyconnect ressources. here is the DACL that use for the authorization profile :

# permit udp any eq bootpc any eq bootps

# permit udp any any eq domain

# permit icmp any any

# permit tcp any host < ISE_Node> eq 8443

# permit tcp any host < ISE_Node> eq 8905

# permit udp any host < ISE_Node> eq 8905

For the Redirect ACL on the switch Catalyst 2960X-15.2.7 :

# deny udp any eq bootps any

# deny udp any any eq bootpc

# deny udp any eq bootpc any

# deny udp any any eq domain

# deny udp any host <ISE_Node> eq 9805

# deny tcp any host <ISE_Node> eq 9805

# deny udp any host <ISE_Node> eq 8443

# permit tcp any any eq www

# permit tcp any any eq 443

on the switch , i can see that is applying the DACL and ACL and giving the URL redirect

Any help please !!

Re: No redirection to ISE Posture Portal

Flavio Miranda — Thu, 31 Oct 2024 14:27:13 GMT

@Monsinka

Can I see the output of "show license" ?

Re: No redirection to ISE Posture Portal

Monsinka — Thu, 31 Oct 2024 14:32:55 GMT

i'm actually using an evaluation license

Re: No redirection to ISE Posture Portal

Flavio Miranda — Thu, 31 Oct 2024 14:36:11 GMT

Keep in mind that LAN Lite model does not support features like CoA or DACLs

Re: No redirection to ISE Posture Portal

Monsinka — Thu, 31 Oct 2024 14:44:44 GMT

it's a Catalyst switch 2960X so i suppose its LAN Base model. Can you please give the link to refer to

Re: No redirection to ISE Posture Portal

Flavio Miranda — Thu, 31 Oct 2024 15:05:12 GMT

You can check a similar thread with Cisco reply

https://community.cisco.com/t5/network-access-control/cisco-ise-acl-and-url-redirect-not-showing-in-show-auth-sessions/td-p/4415933

Re: No redirection to ISE Posture Portal

Monsinka — Fri, 01 Nov 2024 14:25:54 GMT

its WS-C2960X-48FPS-L , its LAN Base model so i think it support DACL and redirection

Re: No redirection to ISE Posture Portal

Monsinka — Fri, 01 Nov 2024 14:31:02 GMT

are the ACL and Dacl correct !

Re: No redirection to ISE Posture Portal

Flavio Miranda — Fri, 01 Nov 2024 14:36:59 GMT

Try to deny the port 443 only for ISE

# deny tcp any <ISE> eq 443

Keep the the permit for everything else

permit tcp any any eq 443

Re: No redirection to ISE Posture Portal

Aref Alsouqi — Fri, 01 Nov 2024 16:41:29 GMT

"deny udp any host <ISE_Node> eq 8443" this line is wrong and it has to be replaced with "deny tcp any host <ISE_Node> eq 8443", ISE portal runs on port 8443 in TCP not UDP. Try to change that and see if it fixes the issue.