Cisco ISE Guest Portal, iPhone User connected but no internet

[a-almisfer]

we have configured a Hotspot guest portal which was working fine redirection is fine now suddenly for iPhone devices its not working connected but no internet same guest portal if i try on android or pc it is working fine,

Both are hitting the same policy, everything seems fine except Profiling 

All devices 

cisco-av-pair

profile-name=Unknown

iPhone 

cisco-av-pair

profile-name=Apple-iPhone

since we have only  essential license I'm unable to find  Work Centers > Profiler > Profiling Policies,

[Aref Alsouqi]

If you are not using profiling on your authoriaztion rule it wouldn't be relevant. I would check with one of those iPhones and see if it gets the right IP in the first place, and then I would try to generate some traffic to the internet and check on the firewall logs and then take it from there.

[a-almisfer]

IP is same as other devices and there is no FW Involved 

[Aref Alsouqi]

What do you mean by no firewall is involved? how would the traffic from the iPhones flow to the internet? wouldn't pass through a firewall? what is the gateway for those iPhones?

[MHM Cisco World]

He use CWA of WLC 

MHM

[Aref Alsouqi]

Yes, but if the iPhones aren't able to connect to the internet, their traffic might be blackholed or dropped somewhere for some reason. Looking at the firewall logs would confirm if the iPhones traffic is actually making it to the firewall and how the firewall deals with it. If that traffic doesn't hit the firewall then it must be blackholed somewhere on the network.

[MHM Cisco World]

Profilling  use which conditions?

Can I see it ?

MHM

[a-almisfer]

this is what i have configured in authorization policy 

[MHM Cisco World]

https://youtu.be/6g_smhZKF14

the order is wrong between Authz line 2 (redirect to hotspot) and Guest-flow authz line 3, Guest flow must above redirect 

also why  you use first line of authz what is meaning ?

[Aref Alsouqi]

Although the "Guest_Flow" rule is placed under the redirection rule, it shouldn't be the issue here because the first rule has the guest identity group identified and should match the guest traffic after the guests have been added to that identity group post redirection.

[Aref Alsouqi]

In other words, the "Guest_Flow" rule would never be hit.

[balaji.bandi]

Adding other comments, is this only issue with Iphone, how about rest of the Guest users using other devices ?

what model of Iphone ? what is your wireless infrastructure information may help here.