Ise client ip flow during web auth

[#1]

Hi everyone,

can it be explained what the client ip address flow is when it tries to connect to a guest ssid for example.

so far I understand the client dhcp to wireless and gets redirected to the ise portal when opening a browser. For connectivity at this point what would be the clients ip ? As it would not be assigned one from the dhcp pool as it has not authicated yet ...

Thanks 

thetone 

[Marvin Rhoads]

The client is given the IP address via DHCP but it is restricted by ACL to only be able to access the ISE portal.

Usually DNS is allowed in the ACL as well to be able to resolve the ISE portal FQDN.

[#3]

Ok thanks Marvin.

Btw is it necessary to explicitly add dhcp in the redirect acl. If not which I have found though my dhcp server is on the same net as client and ap (in lab)

[Marvin Rhoads]

If you don't need to leave the local subnet for DHCP services then - no, you don't need an ACL permitting that traffic.

It would be unusual to see that outside of a lab or very small environment though, so most guides will recommend including the ACL.