Https redirection issue for Wireless Guest CWA - ISE 1.3

[deepuvarghese1]

Our Setup is

ISE 1.3 (Patch level 2) running on ACS 1121

2 nodes clustered with Admin, monitoring, policy service enabled ( Primary and Secondary ).

Configured SSID Guest for Centralized web authentication with ISE.

We have issues in web redirection with chrome . It is not redirecting to the ISE page but rather showing " Page cannot be displayed".

By default chrome is pointing to https. For example if we type https://google.com it is not redirecting to ISE page. But when I specify the same as http://google.com it works.

There is no issue with IE, Firefox as it is redirecting to ISE page with default https and i can see it is hitting our rule.

Please advice.

[nspasov]

Can you post a screenshot of your redirection ACL

[deepuvarghese1]

Hi Neno,

Please find the attached ACL for CWA. The IP's mentioned in ACL are ISE primary and secondary.

[nspasov]

Hmm, things look correct. Have you tried to clear the cache/cookies in chrome and then try again. 

[deepuvarghese1]

We have tried in many PC's with chrome but the result is same even after clearing the cache/cookies. Other browsers are working fine. Please suggest.

[nspasov]

Yeah, I updated my chrome browser and now facing the same issue. I am guessing something changed within the dynamics of chrome that broke this. Are you by any chance using a self-signed certificate? I am having the feeling that it has something to do with untrusted certificates. 

[deepuvarghese1]

One of the PC Chrome version that we tested is with 40+ .

Page is not prompting for any certificate error while trying to load the page rather showing "page cannot be displayed". I will cross check what is the settings of their current certificate. I can try using a self signed cert if needed. 

[deepuvarghese1]

Hi Neno

They are using a third party certificate (digi cert) for client auth. They have confirmed even if they use a self-signed-cert the result is same.

So basically none of the https page is not loading. If we manually browse some https site from Firefox, IE the result is same showing " page cannot be displayed".

Redirection to https is the problem which i have never faced with my other customer. This is the upgraded version of ISE from 1.2 to 1.3.

[paulnus001]

I did a +1 on this issue as well. We have instructed users to use other browsers for authentication against the wireless.