Guest users connected on WIFI but no internet

[Weezy-F]

Our Guest users are able to connect on WIFI. I was able to verify it successfully authenticated on our CISCO ISE and WLC is working properly. 

Is there a way that I can Reset the policy counters on CISCO ISE via CLI? Please let me know

[MHM Cisco World]

Mostly issue with ACL' 

Can I see redirect ACL ?

Can I see ISE log live ?

MHM

[Weezy-F]

Everyone thank you for your response.

 So, here's what we found out. Either a setting reverted on the portal or it’s just corrupt. the profiles just get corrupt if a process ends weird. So right now the SINGAPORE SITE is working properly now, however our Kuala Lumpur Site is not. So the main issue is whenever our Local IT tries to generate a PW on Sponsored Guest portal, when they login they have an error 400 bad request. It's been fix now. 

Singapore is working properly, but Kuala Lumpur is not. They can access the portal and they can provide password to the guest users however when the guest users connect on our WIFI it says No internet. Our settings on ISE are all correct ACL, AUTH profile, and eveything because the Singapore is working properly.  But the KL is not. I'm thinking our Cisco WLC have an issue? what you think?

[MHM Cisco World]

Try ping from wifi client to GW 

If sucess check NAT 

If not check GW IP in dhcp server 

MHM

[Weezy-F]

GW is reachable, the NAT is there also, as well as the DHCP is working.

One thing I notice if we add the mac manually on ISE under group WIFI-MAB group the user will be able to access the internet. 

But prior adding their MAC on ISE, they can connect on WIFI but it says no internet.

[MHM Cisco World]

I send you PM 

MHM

[Weezy-F]

Replied on you

[Weezy-F]

I sent you a PM too. Thank you.

[Flavio Miranda]

@Weezy-F 

You take a look on the command "application configure ise" but be careful with this command. 

If you can, run It in a lab First. 

[Weezy-F]

 So, here's what we found out. Either a setting reverted on the portal or it’s just corrupt. the profiles just get corrupt if a process ends weird. So right now the SINGAPORE SITE is working properly now, however our Kuala Lumpur Site is not. So the main issue is whenever our Local IT tries to generate a PW on Sponsored Guest portal, when they login they have an error 400 bad request. It's been fix now. 

Singapore is working properly, but Kuala Lumpur is not. They can access the portal and they can provide password to the guest users however when the guest users connect on our WIFI it says No internet. Our settings on ISE are all correct ACL, AUTH profile, and eveything because the Singapore is working properly.  But the KL is not. I'm thinking our Cisco WLC have an issue? what you think?

[Flavio Miranda]

@Weezy-F 

 Next step is check on the WLC. Can you enable a debug on the WLC , do the tests and share the logs here?

[Weezy-F]

I did reboot the WLC just 5 mins ago, still waiting for the local IT update.

[iLoveBGP]

If your guest users are successfully connecting to Wi-Fi and authentication through Cisco ISE is confirmed, but they lack internet access, the issue might lie in the policy enforcement or network path. Resetting policy counters on Cisco ISE could help diagnose or resolve such issues.

To reset policy counters via CLI, you can use the following command:

application stop ise application start ise

This restarts the ISE application, effectively resetting policy counters and clearing cached sessions. Before doing this, ensure that restarting ISE won't disrupt ongoing authentications or network functionality, especially if it’s in a production environment. Alternatively, if you’re troubleshooting session-specific issues, you can clear individual sessions through the GUI by navigating to Operations > Radius > Live Sessions and manually terminating or refreshing problematic sessions.

If the issue persists, verify network configurations, including VLAN mapping, firewall rules, and ACLs applied to guest traffic. There could be restrictions in the network path preventing internet access for guest users.

[Weezy-F]

ACL's and everything are set correctly as the SINGAPORE site works well, however on KL is not. Also I cleared the counters as well on CISCO ISE but didn't resolve the issue.