Guest Portal Using ISE with Flexconnect Mode

[SiJian Bao]

Folks,

I have configured my guest web authentication using ISE with flexconnect mode like this:

http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bcb905.shtml

After done, I connect the SSID but cannot log in. I cannot get IP address and in the ISE I can see that my device has already hit my authorization profile and the status is pending. Can anyone help me with this?

[Richard Atkin]

WebAuth won't do anything without the Client having an IP Address so that's what you need to fix first. Check the DHCP Helper-Addresses on your VLAN interfaces and the scopes themselves in the DHCP Server.

Sent from Cisco Technical Support iPad App

[SiJian Bao]

Yeah, you and Nicholas are right. In the FC ACL i dont permit the DHCP server. And I found that the ACL should be created in both FC ACL and regular ACL.

[Nicholas Poole]

As Richard says, check to see if you have an IP address.  If not check the AP settings for FlexConnect.  Is the mode on the AP set right?  Please confirm that you are using FC local switching and not centralised switching? 

Is the VLAN tagging enabled on the AP, and/or the VLANs on the AP switchport set right?

[Ravi Singh · Accepted solution]

There is problem with your DHCP server. Until unless you will not get IP address you cannot be authenticated by ISE. Please check you DHCP server is working or Not.

[SiJian Bao]

Yup Ravi, as i have mentioned above, I deny the DHCP server in my ACL and it is working now after I permit the server