Cisco ISE web redirect not working

[Jason Weids]

Can anyone help with this. I have an open SSID doing MAC filtering to ISE with the following auth rules;

My devices is hitting correct rule for the unknown MAC but it is not redirecting me to the guest portal & is allowing me access in the associated VLAN assigned to the WebAuth policy.

[Jason Weids]

How is this meant to work for guests then?

I have now imported the certificate to the machine & it is now trusted & all browsers working. I'm confused how this is going to work for guests on their own devices though.

[Rob Ingram]

That QuoVadis CA certificate is possibly not, as default installed onto a computer compared to Comodo, Entrust, Verisign etc which are. Possibly use one of these other CAs which should ensure trust for most devices (hopefully).

HTH

[Jason Weids]

So do I need to use one of the trusted certificates in ISE for the guest portal, like the verisign class 3 public certification authority?

How do I apply this to the guest portal?

[Jason Weids · Accepted solution]

After applying the cert to the admin role & restarting ISE all portals on all browsers are now accepting the certificate. Seems strange that they didn't when we applied it to the portal role because that doesn't require a restart.

[dcnguyen]

Don't think it has anything to do with the admin role.  The reboot was actually what fixed it for us.  We applied our cert only to the portal role and ISE did not require a reboot, it does require reboot if you are applying it to admin role.  For us we were just applying the cert to the portal.  You have to reboot for it to work.  White screen went away and client was able to web_auth after the reboot. 

[bern81]

you can use self-signing portal with sponsor approval.
like this when the guest get the redirect page, he has to create a user and who he is visiting.
the request goes to a sponsor account email that approve the guest and define the duration for the connection.
the guest received an email with his passwd and can access internet.

[Jason Weids]

Unfortunately that doesn't fit our use case.