topic not work!!! :( switch#show in Network Access Control

CWA NOT REDIRECT AUTOMATIC IN CLIENT WEBBROWSER

claudioparker — Mon, 11 Mar 2019 04:49:11 GMT

Guys, i have problem, the the portal cwa not open automatic in clients, if the client copy and paste the url of session, this open!! but automatic is the problem, the acl is ok, dns is ok.

switch version 15.2

switch#SH EPm SESSion ip 172

claudioparker — Mon, 23 Jun 2014 15:38:35 GMT

switch#SH EPm SESSion ip 172.16.1.3
Admission feature: DOT1X
ACS ACL: xACSACLx-IP-POSTURE_REMEDIATION-53a84454
URL Redirect ACL: ACL-POSTURE-REDIRECT
URL Redirect: https://xxx:8443/guestportal/gateway?sessionId=AC101E640000005F032D6B3B&action=cwa

Could you share what you are

Sam Hertica — Mon, 23 Jun 2014 16:45:17 GMT

Could you share what you are using as a redirect ACL please?

acl-redirectdeny ip any host

claudioparker — Mon, 23 Jun 2014 16:48:28 GMT

acl-redirect

deny ip any host ISE

permit tcp any any eq 443

permit tcp any any eq 80

IF I copy and paste url in webrowser work, but automatic redirection not working

You also need to deny DNS

Sam Hertica — Mon, 23 Jun 2014 16:52:32 GMT

You also need to deny DNS traffic for this to work. The way it is now, you can try to go to any IP address (like 1.1.1.1) and you should see the redirect pop-up in the URL bar.

It seems like currently we're trying to 'redirect' DNS traffic, which causes the end-clients to time out.

then you say that i should

claudioparker — Mon, 23 Jun 2014 17:00:09 GMT

then you say that i should add

deny udp any any eq domain in the acl-redirect in the switch?

Right!

Sam Hertica — Mon, 23 Jun 2014 17:34:41 GMT

Right!

not work witch#show ip access

claudioparker — Mon, 23 Jun 2014 17:41:21 GMT

not work

witch#show ip access-lists
Extended IP access list ACL-POSTURE-REDIRECT
10 deny ip any host 172.16.30.20 (1927 matches)
15 deny udp any any eq domain (42 matches)
20 permit tcp any any eq 443
30 permit tcp any any eq www
Extended IP access list Auth-Default-ACL
10 permit udp any range bootps 65347 any range bootpc 65348 (8 matches)
20 permit udp any any range bootps 65347
30 deny ip any any (11 matches)
Extended IP access list xACSACLx-IP-POSTURE_REMEDIATION-53a84454 (per-user)
10 permit tcp any host 172.16.30.20 eq 8443
20 permit tcp any any eq www
30 permit tcp any any eq 443
40 permit udp any any eq domain
50 permit icmp any any

not work!!! :( switch#show

claudioparker — Mon, 23 Jun 2014 18:10:17 GMT

not work!!! 😞

switch#show authentication sessions interface fastEthernet 0/1

Interface: FastEthernet0/1

MAC Address: 6431.5077.5aa2

IP Address: 172.16.1.2

User-Name: 64-31-50-77-5A-A2

Status: Authz Success

Domain: DATA

Oper host mode: multi-auth

Oper control dir: both

Authorized By: Authentication Server

Vlan Policy: N/A

ACS ACL: xACSACLx-IP-POSTURE_REMEDIATION-53a84454

URL Redirect ACL: ACL-POSTURE-REDIRECT

URL Redirect: https://ise.xxxx:8443/guestportal/gateway?sessionId=AC101E64000000000000A676&action=cwa

Session timeout: N/A

Idle timeout: N/A

Common Session ID: AC101E64000000000000A676

Acct Session ID: 0x00000001

Handle: 0x90000001

Runnable methods list:

Method State

mab Authc Success

dot1x Not run

Did anyone get this working??

2edc3rfc — Thu, 20 Apr 2017 00:20:25 GMT

Did anyone get this working??