ISE Guest Hotspot Portal Redirection using HTTP

[Florian P]

Hello everyone,

I have currently an issue with the Guest Hotspot Portal. Is it possible to force ISE to redirect the CWA flow using http ?

The issue is the following :

I am providing free WiFi access and ISE is used to authenticate external Guest with a Hotspot Portal (AP are configured in FlexConnect mode to keep all that trafic located in the branch office). The devices are of course unmanaged and redirected to the ISE's interface used in the portal (it is hence an internal IP with its associated FQDN). We have unfortunately no way to resolve this FQDN locally and the redirection is pointing on ISE's IP.

Since 10/2016 the Public Certificate Authorities have been refusing to sign SAN Certificate containing IP Adress. So a users are experiencing certificate errors before they can register on the portal.

Thanks for your help,

FPI

[Marvin Rhoads]

You can either allow your internal DNS server is the redirect ACL (if you assign that server via the DHCP options) or else create a public DNS A record for your ISE server's internal address and FQDN.

[Florian P]

I would like to avoid allowing my internal DNS in the redirect ACL since it could reveal our internal DNS topology to Guest users. I am going to DNS public record pointing to ISE internal IP Address.

If there is any trouble with ... maybe DNS views could be an option.