Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1504
Views
1
Helpful
2
Replies

ISE 2.1 Wired Guest Flow VLAN IP Release/Renew Issue

Go to solution
nadeekha
Level 1
Level 1

‎02-01-2017 09:16 AM

HI Experts,

I have implemented a rule for my customer to have Guest users go through CWA redirect and after authorization get placed into the Guest VLAN.  The entire flow works as expected the Guest user is first in the Corp VLAN (obtains ip from that VLAN) to access the CWA portal and then gets put into the Guest VLAN. The issue I am seeing is that once the user is put into the Guest VLAN the IP Address release/renew does not occur right away. It takes 10-15 minutes if nothing is done.Manual renewal of IP works right away.

If I enable the "VLAN DHCP Release Page" setting on the portal  then the user gets prompted for installing the applet and then the ip is renewed automatically. I have tested the applet on Windows and it works.

My questions are below:

1. Is there another way to handle this without user intervention. Some way that once put into the Guest VLAN the DHCP renew would automatically be initiated?

2. I have tested the Java Applet on Windows and it seems to work what about other guest endpoints  OSX etc. Any known issues or gotchas for non windows devices.

Thanks

Nadeem

1 Accepted Solution

Accepted Solutions

Go to solution
Jason Kunst
Cisco Employee
Cisco Employee

‎02-01-2017 09:37 AM

Its not recommended to do VLAN changes for guest as there are issues with java active X applets and you have no control of guest devices.

There is no supplicant like dot1x to control the IP change

If you must change IP addresses, then the recommendation would be to do either of the following:

· Don’t use the applets

· Setup a low DHCP lease time for the initial VLAN so when the user moves its updates quickly

· Have the user login with CWA and then Register the endpoints by redirecting to a hotspot portal that will disconnect them after registration and cause a new connection on the new VLAN coming through

· Use dot1x for the guests by pre-registration or have them register for an account (make sure you use an account that’s activated immediately (from first login or make sure to check the bypass guest portal in the guest type)

View solution in original post

0 Helpful