ISE CWA not working properly

[Cheezus01]

Hello!

So I've setup a wireless CWA guest SSID using a ISE 1.3 and I've followed this guide, http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

The problem now is that the first authorization policy, "networkaccess:usecase EQUALS Guest Flow", never seems to kick in, because users recieve the login successful message and you can see the redirect link to the set website for a second and then it goes back to the login portal and prompts for login again. After reviewing the logs it seems like the ISE sets the profile to the redirect profile after successful login attempts, when it should be setting the Permit_Access profile. I read a note somewhere that in ISE 1.3 the "Guest Flow" flag might not work, but then again I've read many guides and manuals that says it should work. Of all the threads and posts I've read where people have had the same issue with the "redirect loop" no answer fixes it, because most of the time it's that they forgot a MAB rule or maybe to enable RFC 3576, but that's not the case here.

[jj27]

Another thing to check is that AAA override is enabled on the Guest WLAN under the Advanced tab.  Also make sure that your Guest Flow Authz rule is above the rule for CWA.

If that does not fix it, what controller and code are you running?

[Cheezus01]

I've checked that.

5508, 8.0.110.0

[Tim Steele]

Do you have an anchor controller in the mix for your guest traffic?  If so, be sure you do NOT have radius accounting enabled on the anchor WLC.  That will cause a redirect loop.  When looking at Live Logs, does the SessionID change when this happens?

Tim

[Andre Neethling]

Can you try this for the AuthZ policy you are trying to apply to the authenticated user? Under Identity groups  select "GuestType_YOUR GUEST IDENTITY GROUP". This will catch the authenticated user and apply the new AuthZ policy. This worked for me.