topic Re: Hotspot portal not assigning endpoints to identity group in Network Access Control

Hotspot portal not assigning endpoints to identity group

Omi+ — Wed, 03 Sep 2025 17:05:28 GMT

Hi, We have hotspot portal (created using ISE portal builder) in ISE 3.3, guest user successfully authenticates and receives AUP page but after accepting AUP , mac address is not getting added to right endpoint identity group. Because of that it is not hitting the Authz rule that matches with that identity group and guest users get stuck in the guest redirection loop.

Sometimes, endpoints gets added to the identity group after AUP acceptance and everything works and sometimes not.Issue is intermittent.

Re: Hotspot portal not assigning endpoints to identity group

MHM Cisco World — Wed, 03 Sep 2025 19:08:43 GMT

can I see ISE policy ?

MHM

Re: Hotspot portal not assigning endpoints to identity group

Omi+ — Wed, 03 Sep 2025 21:15:21 GMT

If wireless_mab and guestendpoint then permit access ---1st Authz policy

If wireless_mab then redirect ---2nd Authz policy

Re: Hotspot portal not assigning endpoints to identity group

MHM Cisco World — Wed, 03 Sep 2025 21:34:14 GMT

All user or some have this issue ?

These user with issue are it wifi android user?

MHM

Re: Hotspot portal not assigning endpoints to identity group

Omi+ — Thu, 04 Sep 2025 05:00:48 GMT

If issue appears then it is for all users who are hitting on that PSN node. android, iPhone, windows machines

Re: Hotspot portal not assigning endpoints to identity group

poongarg — Mon, 08 Sep 2025 06:37:11 GMT

If the issue is with specific PSN node, then I would suggest to perform a manual sync of that PSN with PAN node.

Re: Hotspot portal not assigning endpoints to identity group

Omi+ — Mon, 08 Sep 2025 08:08:20 GMT

it is not specific to any PSN. we have 3 PSN nodes, all of them are having this issue.

Re: Hotspot portal not assigning endpoints to identity group

MHM Cisco World — Mon, 08 Sep 2025 08:42:29 GMT

You use some type of load balance?

Try make WLC for specific ssid use one PSN and check.

It can the user hotspot to one PSN and then use different PSN for re-auth

MHM

Re: Hotspot portal not assigning endpoints to identity group

Aref Alsouqi — Tue, 09 Sep 2025 09:37:15 GMT

I would recommend working with TAC on this as it could potentially be an issue with ISE database. In the meantime you could try to create a new authorization rule and use the "Guest_Flow" condition and see if that makes any difference.