topic Re: ISE guest hotspot post-auth issue in Network Security

ISE guest hotspot post-auth issue

pb100 — Thu, 25 Jul 2024 14:49:43 GMT

ISE 3.3.0 running on 3615 appliances

IOS-XE 17.9.5 on 9800-40 WLCs

We have some odd behaviour with a new hotspot portal. Everything up to authentication appears to be working correctly - user is prompted to sign in on connecting to the SSID, redirect is sent to the WLC, portal page is displayed, internet ACL is sent to the WLC when the user accepts the ToU, and the authentication success page is displayed.

However with some devices the user still does not have network access. This primarily appears to affect Android devices, but not all - I haven't observed it with iOS or Windows clients. Refreshing the auth success page does something which causes auth to be successful/the internet ACL to be applied correctly, and the network then shows as connected and the user has internet access.

The fact that this isn't universal in our deployment suggests it's a client issue, but I'm at a loss to understand how a client issue could apparently prevent the correct ACL from being applied by the WLC!

Has anyone come across this issue before? Any pointers on whether it's likely to be an ISE, WLC or client issue, and on where I can look to gather more information if it isn't client? Thanks!

Re: ISE guest hotspot post-auth issue

balaji.bandi — Thu, 25 Jul 2024 15:42:59 GMT

how is the certs configured, is this FQDN or IP ?

Make sure the valid cert trusted by the client, always suggest to use cert Public signed one.

check the packet flow :

https://www.youtube.com/watch?v=MOIpRLpfGvo

Re: ISE guest hotspot post-auth issue

MHM Cisco World — Fri, 26 Jul 2024 10:48:56 GMT

If device use randomize MAC then it will failed to access'

The ISE learn MAC and add it to identity group so it will use it after CoA'

If Android use this feature then it mac is change always and it failed to authc/authz by ISE

MHM

Re: ISE guest hotspot post-auth issue

GregWeaver — Thu, 12 Dec 2024 16:14:47 GMT

Hello,

I am dealing with the same issue, did this end up being a cert issue like Balaji.Bandi suggested?

Thanks

Re: ISE guest hotspot post-auth issue

t-sassatelli — Wed, 09 Jul 2025 14:03:19 GMT

Hello,

I am dealing with the same issue, the problem appear after the software upgrade on mobile android device. Other suggested?

Best regards