topic Re: Auth VLAN, URL Redirect and DNS Sinkhole... in Network Access Control

Auth VLAN, URL Redirect and DNS Sinkhole...

rezaalikhani — Sun, 22 Dec 2024 10:53:49 GMT

Hi all;

I use Ubiquiti access points in my network and want to implement Guest Services (Central Web Authentication). As far as I know, this type of devices does not support RADIUS URL Redirection from ISE. Therefore, I decided to circumvent this limitation using DNS Sinkhole functionality in ISE. As you can see in the following figures, the endpoint (after connecting to the appropriate SSID), receives required IP Address and DNS info correctly (I have added a second interface to ISE with IP address of 172.16.10.120😞

After successfully acquiring the required DHCP information from ISE, the client opens the following browser window:

As you can see above, the redirection process times out. The following figures show the Wireshark capture of the process:

Any ideas?

Thanks

Re: Auth VLAN, URL Redirect and DNS Sinkhole...

Flavio Miranda — Sun, 22 Dec 2024 12:29:29 GMT

@rezaalikhani

All similar implementation I can see, uses CoA. Does you device support CoA.

https://www.linkedin.com/pulse/cisco-ise-dns-sinkhole-functionality-smart-way-support-alikhani/

Re: Auth VLAN, URL Redirect and DNS Sinkhole...

rezaalikhani — Sun, 22 Dec 2024 13:52:06 GMT

Thanks for your reply;

Yes, it does...

I want to know that, if I have several portals published in the dedicated interface, how ISE determines which to offer to the endpoint?

Thanks

Re: Auth VLAN, URL Redirect and DNS Sinkhole...

Flavio Miranda — Sun, 22 Dec 2024 14:29:53 GMT

@rezaalikhani

Re: Auth VLAN, URL Redirect and DNS Sinkhole...

rezaalikhani — Sun, 22 Dec 2024 14:47:09 GMT

Thanks for your reply;

I do not think the provided link answers my question because based on my assumption we cannot specify any portals in the Authorization profile, because the target device does not support URL Redirection RADIUS attribute. Right?

Re: Auth VLAN, URL Redirect and DNS Sinkhole...

Flavio Miranda — Sun, 22 Dec 2024 15:39:57 GMT

Actually the post in question address you question related to support for multiples portal per interface.

Regarding your scenario, the first link have the answer as long as you can do CoA, which seems you are not doing as your attempt stop in the 303 moved permanently.