ISE Guest Portal Wrong authorization match for Linux OS endpoint

[edwardonelife]

Scenario

We have Ubuntu Linux based guest users connecting to the wired network and authenticating using the guest portal.

In most cases the authorization matches the wrong authz policy as ISE doesn't seem to use the guest username and instead uses the endpoint mac address.

The Authorization policy condition is set to match the guest username to the correct user identity group.

What could be the root cause?

ISE v2.7p3

Successful authorization Log in ISE

11017

RADIUS created a new session -                             johndoe

	24631	Looking up User in Internal Guests IDStore
	24632	Found User in Internal Guests IDStore
	24209	Looking up Endpoint in Internal Endpoints IDStore - johndoe
	24211	Found Endpoint in Internal Endpoints IDStore

UN-Successful authorization Log in ISE

11017

RADIUS created a new session -        00-16-45-00-00-00

	24209	Looking up Endpoint in Internal Endpoints IDStore - johndoe
	24211	Found Endpoint in Internal Endpoints IDStore
	24209	Looking up Endpoint in Internal Endpoints IDStore - johndoe
	24211	Found Endpoint in Internal Endpoints IDStore

[Greg Gibbs]

I'm not sure what you mean by "Authorization policy condition is set to match the guest username to the correct user identity group."

I would suggest comparing your environment and policy configuration against the Guest Access Prescriptive Deployment Guide.

If you still need help, please provide more information and screenshots of your Authentication and Authorization Policies and other relevant configuration elements.

[edwardonelife]

Hi Gibbs,

After logging in to the Guest portal, we are expecting the below condition to match so that the correct authZ profile is assigned to the guest.

IdentityGroup:Name EQUALS User Identity Groups:GuestType_Contractor_ABC

Basically we are checking if user johndoe is in GuestType_Contractor_ABC identity group. This condition is not being matched during the GuestFlow process from my analysis.

Successful Match - Queried PIP.Guest.UserName can be seen

Unsuccessful Match - Queried PIP.Guest.UserName is NOT seen

This is a production environment and has been working fine apart from Linux guest machines which are a hit-and-miss.

[Greg Gibbs]

I have used the GuestType matching condition in multiple customer environments (with the Remember Me option) and I don't recall any issues with it.

Does this happen after a period of time (like after a periodic reauth) or can you consistently duplicate the issue?

What other matching conditions would make the guest endpoint hit an AuthZ Policy for a Contractor instead of hitting your default guest redirect policy?

If you delete the endpoint from ISE and reconnect, does the guest flow work again? If so, there could be some issue with the endpoint getting put into an Endpoint Identity Group automatically that's being matched on a diff AuthZ Policy.

There's still not enough info to provide any meaningful assistance. I would suggest opening a TAC case to investigate further.