ISE 2.4 Guest and Sponsor Portal Issue

[scottbreslin]

Hi Guys,

I have a customer who is wanting to setup Guest and Sponsor Portals on their ISE (2.4 Patch 8).   Both portals are configured to use the same Certificate Group Tag, the certificate is signed by Entrust and configured for Portal usage.   

The guest portal is configured to use port 8443 on Gig 2

The sponsor portal is configured to use port 8443 on Gig 0 and using a FQDN (Internal DNS servers have been updated to resolve the ISE ip)

When a wireless client accesses the guest portal, everything works fine.  However, when a client accesses the sponsor portal from the internal network, the ISE is presenting its admin certificate rather than the Entrust one.  As such the client receives a certificate warning 

Its as if the ISE is ignoring the certificate group tag that its been configured with.

Any idea on how to resolve this issue please?

Thanks 

Scott 

[ahollifield]

Yup really common issue on ISE.  I usually put the sponsor portal URL as a SAN name in the admin certificate since ISE does a very strange redirection to the sponsor portal.  It connects to standard HTTPS/443 first which uses the admin certificate.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-743964.html

[scottbreslin]

Thanks for the reply.

So based on what you have said, I can create a self signed certificate, add the FQDN of the sponsor portal into the SAN and tick the admin usage box.  Do i also need to tick the portal usage box?

[ahollifield · Accepted solution]

But your clients won’t trust a self-signed certificate. If you are using a public certificate for admin, you should get a new certificate and add the sponsor URL as SAN entry. Same if you are using a private CA.

[scottbreslin]

Yes the admin portal is currently using a cert signed by their private CA