hotspot portal portal redirection issue

[aravikumar]

Hi

I created the policy sets for hotspot portal but I am not seeing my endpoint redirecting to the portal. I am being allowed access to the internet. I am running ISE 2.4 p9. I have added the ise fqdn in dns. portal test URL is working. The guest flow is not working. I tried multiple combinations of guest flow but it is not working. Any help would be appreciated. I followed the cisco guide to configure this. But redirection is not happening. Instead of redirecting to the portal it is allowing internet access.

Attached is the policy set screenshot.

Thanks,

Aravind.

[Francesco Molino]

Hi

We see 39 hits on your cwa rule which means some endpoints must be redirected when hitting that rule.

Can you share your cwa authorization details rule?
Is this for wireless or wired?
Can you share your wireless acl as well please?

[aravikumar]

Hi Francesco,

Thank you for your timely response.

This is a wireless guest usecase. I have attached the redirection authz profile and the WLC ACL screenshots. Please let me know if something is missing. I am not being redirected to the portal.

Thanks,

Aravind.

[paul]

If you look at the client details on the WLC is the user in CENTRAL_WEBAUTH_REQUIRED?

I always put a deny ip any any entry at the end of my redirect ACL, but should be implied.

[Francesco Molino]

Can you take a screenshot of your user status?
Do you see the redirect acl in your user status?

Your line 3 doesn't make any sense.
Usually the redirect acl should be:
REDIRECT_ACL:
- Allow DNS (UDP and Dest port DNS) / Inbound Direction
- Allow DHCP / Inbound Direction
- Allow ISE / Inbound Direction
- Allow ANY / Outbound Direction

The source should be 0.0.0.0/0 but destination should match what given above. Can you test it and let us know?

[aravikumar]

Hi Francesco,

Thank you for the corrections
So i can see redirection happening for windows workstation, iPhone and android. But Redirection is not happening for Macintosh. The captive portal pop up is coming but the actual ise portal is not loading on the macintosh machine.

I took packet captures on both windows(working) and mac(not working) endpoints. Any help would be appreciated.

Thanks,
Aravind.

[Jason Kunst]

Please make sure you have a valid certificate installed for the portal.

Here are some recommendations
Http://cs.co/ise-guest check out prescriptive guide
https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

[aravikumar]

Hi Jason,

Thank you for your response. My portal certificate is signed by my internal CA and I am not using the default self signed certificate. I tried with endpoints that are not part of the domain for the guest usecase. As mentioned before the endpoints in this case are Macintosh, iPhone, Android Phone and Windows workstation. Though the macintosh is ttempting to load the redirection portal, it throws an error where "A problem occurred. The webpage couldn't be loaded". Does this mean the macintosh is not accepting the CA signed certificate presented by ISE? 

Thanks,

Aravind.

[Francesco Molino]

I'll look at your captures later and come back to you.
Can you detail the ise portal configuration? Is it in a different interface than the admin one? If so, the host is configured and machines are able to resolve the fqdn?

[Francesco Molino]

Your mac client is 10.254.4.238.
I do see the redirect url on your capture, syn initiated by your ise and then your client doing a rst.

Do you have any firewalls on your client?

[aravikumar · Accepted solution]

Hi Francesco,

So the issue got resolved after i upgraded the Mac OS. I was able to see the captive portal pop up successfully.

Thanks for your help.

Thanks,

Aravind.