topic Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint in Network Access Control

ISE3.2- Self-registration users cannot be updated in GuestEndpoints

Magret — Wed, 12 Mar 2025 08:20:59 GMT

Self-registration users cannot be updated in GuestEndpoints after users pass authentications. And CoA cannot be triggered.

I read this article:https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216191-troubleshoot-common-cisco-ise-guest-acce.html

It seems that CoA will be triggered automatically after self registration users passing authtentications.

I did all the config according to this article:https://community.cisco.com/t5/security-knowledge-base/how-to-cisco-ise-captive-portals-with-aruba-wireless/ta-p/4633904

Can anyone explain the logic behind this and find out why this issue happens?

Best Regards

Magret

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Arne Bier — Wed, 12 Mar 2025 23:02:08 GMT

Your screenshots are not very helpful - without the details (i.e. we need more than seeing a red "failed" icon), it's impossible to tell what's gone wrong. Show us the details, and then also prove to us that the CoA was sent by ISE, and acknowledged by the Aruba AP. a tcpdump on ISE is a good place to start.

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Magret — Mon, 17 Mar 2025 08:16:39 GMT

Actually the current issue is that portal user cannot be put into GuestEndpoint, which then cannot trigger coa profile.

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Arne Bier — Mon, 17 Mar 2025 20:58:05 GMT

The problem description was clear from your first posting. But if you want assistance with finding the cause, then please supply us with some data to investigate. None of us here are clairvoyant.

Screenshots of your ISE Policy Set
- Authentication ... show the action for "If user not found" also)
- Authorization
Screenshots of your Guest Type
tcpdump of the RADIUS traffic before, during and after a user attempts to log into the portal (we want to see the Access-Request MAB to ISE, and the responses to the NAD (hopefully the URL redirect), and then any other RADIUS traffic thereafter)
Live logs details of the MAB session
Operations / Reports relating to Guest Portal - there are a few Reports to choose from - I can't remember which one

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Magret — Tue, 01 Apr 2025 03:42:41 GMT

Thanks for the reminder.

The policy set details are as below:

Authentication:

Authorization Policy:

Guest Type:

Session log：I also attached detailed info as pdf

TCP dump: I start tcp dump first and then connect SSID, after device pops out login page, I registered a new accont and login, then I stopped the tcp dump. Strange thing is that I didn't see radius related packet capture in tcp dump. However, I can see radius request in NAS(aruba controller) packet capture.

I attached Guest report as CSV type.

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Arne Bier — Sun, 06 Apr 2025 21:02:11 GMT

In your ISE Guest Type definition, you show that you're using Identity Group 'GuestEndpoints' - which means that if a guest logs into the portal and provides the correct creds, then their MAC address gets added to GuestEnpoints. However, in the 'Session log - Guest auth.pdf' I see another Endpoint Identity Group mentioned - "GuestType_Guest-Daily" - since your Authorization Rule mentions 'GuestEndpoints' as the Group for which you want to grant access, you need to use this Group. Where does "GuestType_Guest-Daily" fit into the picture?

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Magret — Mon, 07 Apr 2025 01:33:03 GMT

Guest Type_Guest-Daily as below：

Re: ISE3.2- Self-registration users cannot be updated in GuestEndpoint

Arne Bier — Mon, 07 Apr 2025 03:03:31 GMT

Ok I see now - the confusion was because in the Live Logs details, a successful authentication shows the User Identity Group, which ISE creates for you internally - always has the prefix "GuestType_". I thought I was looking at the Endpoint Identity Group. Those are two different things. So your output looks ok.

I can't tell what the issue might be.