Cisco ISE problem redirecting to the portal

[sedovsergei100]

I have a Cisco ISE and WLC. A redirection profile to the portal is configured on Cisco ISE.
Access Type = ACCESS_ACCEPT
cisco-av-pair = url-redirect-acl=GUEST_ACL
cisco-av-pair = url-redirect=http://portal.website.com
Everything works well.
But when I give full access to the Internet in the ACL (GUEST_ACL), redirection to the portal stops working.

[sedovsergei100]

the "portal.website.com" is on my network

[ahollifield]

What "WLC"?  AireOS?  9800? 

GUEST_ACL should NOT be full internet.  It should only allow DHCP, DNS, and Access to the ISE PSNs.

https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

[sedovsergei100]

WLC - Cisco 5520 Wirless Controller

I need the devices to have full access to the external network at the time of transition to the portal.
Ideally
ACL - permin any any
But with such a ACL the transition to the portal is not carried out.
It was experimentally established that
ACL
deny any 104.86.110.0/24
permit any any
It can open a portal on devices with the Windows operating system, but on mobile devices (Android, iOS) the transition is not carried out.

[ahollifield]

What do you mean by "transition"?  You need to have a redirect ACL to actually "redirect" traffic to the portal. Why are you permitting all traffic before the client logs into the portal?

https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

[sedovsergei100]

The general idea is this. The user connects to WiFi. ISE assigns it security group 1 and redirects it to the internal network site. Now the user can perform actions in accordance with the policy for SG1 on FirePower. To do this, I need to allow full access to the user on the WLC when going to the site

[ahollifield]

"internal network site" - is this an ISE Guest Portal?  Something else?  Please read this guide, especially the portions on the redirect ACL: https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

The wireless controller should be managing the ACL, not the upstream firewall.  Once the user has authenticated to the portal then assign the appropriate security group.

[sedovsergei100]

"internal network site" - is not a Cisco ISE portal. This is a website and information for guests.
In document https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475 in section "Configure an ACL to Redirect Guest Devices to the ISE Guest Portal", paragraph 8, the ACL that I need is indicated.
The problem is that with this ACL the transition to the site using:
cisco-av-pair = url-redirect-acl=GUEST_ACL
cisco-av-pair = url-redirect=http://portal.site.com
With the ACL from "Configure an ACL to Redirect Guest Devices to the ISE Guest Portal", paragraph 7, the user will be redirected to the site.

[ahollifield]

Oh, now it makes more sense.  Why are you doing redirect then at all?  What exactly are you trying to achieve?  ISE will not redirect to a non-ISE portal.  You need to handle that redirection directly on the WLC.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71881-ext-web-auth-wlc.html

https://www.cisco.com/c/en/us/products/collateral/wireless/5520-wireless-controller/eos-eol-notice-c51-744430.html

[sedovsergei100]

If I redirect a user to a site using a WLC, I will not be able to assign a security group (TrustSec) to him.
I can only do this on ISE
Access Type = ACCESS_ACCEPT
cisco-av-pair = cts:security-group-tag=0003-7
cisco-av-pair = cts:sgt-name=SG3
cisco-av-pair = cts:vn=
Tunnel-Private-Group-ID = 1:
Tunnel-Medium-Type = 1:13
Tunnel-Type = 1:6
cisco-av-pair = url-redirect-acl=GUEST_ACL
cisco-av-pair = url-redirect=http://portal.site.com

[sedovsergei100]

On the WLC you can assign the SG value to the SSID. But how can you force devices to open a website page when connected?