Blocked List Portal redirection problem...

[rezaalikhani]

Hi;

Consider the following scenario:

• ISE 3.2 Patch 4
• Cisco vWLC 8.10.190.0
• Windows 10 with Google Chrome 119

A user reports their device as 'Stolen' in the 'My Device Portal' and then connects the same device to the network. Based on the following authorization policy, it should redirect to the 'Blocked List Portal':

Based on the RADIUS Live Logs, the aforementioned authorization policy matches successfully, and ISE pushes it to the WLC. However, when the user opens a browser, instead of redirecting to the Blocked List Portal, the following error message appears:

I've checked everything, but one thing caught my attention. When I opened the portal using the 'Portal test URL' link within the portal configuration, it opened with the following address and correctly displayed the desired message:

https://192.168.10.120:8444/blockedportal/PortalSetup.action?portal=23be8780-da68-447e-aec3-e159cfb2a288

Now, I checked the portal address in the Authorization Profile and it is:

https://ip:port/blockedportal/gateway?portal=23be8780-da68-447e-aec3-e159cfb2a288

Then I changed the above address with the address of the "portal test URL" as follows:

https://ip:port/blockedportal/PortalSetup.action?portal=23be8780-da68-447e-aec3-e159cfb2a288

Now tested again and this time the user redirected to the portal as expected!!!

Any ideas?

Thanks

[Greg Gibbs]

@rezaalikhani , I see the same behaviour in ISE versions 3.2p4 and 3.1p8.

I suspect something changed and the "PortalSetup.action?" is the correct redirect-url to use in the AuthZ Profile, but you would have to open a TAC case to confirm that. If this expected behaviour, TAC should also file a documentation bug to ensure all of the relevant Admin Guides are updated.

[rezaalikhani]

I tested this on ISE 3.3 with Path1 with the same condition...

[hslai]

@rezaalikhani Thanks for reporting this. I will do more research on this. Meanwhile, please continue using your workaround.

[hslai]

@rezaalikhani CSCwi62078 filed on this and should be visible after 1 or 2 business days.