ISE hotspot page not loading on Guest SSID

[connor-jaques]

We are in the process of moving from On-Prem ISE 2.7 to Azure 3.3 - fresh build.

AP's are Cisco Meraki, none of the guest SSID setup has been changed bar the Radius server IP's.

Guest portal is DNS resolvable from AP subnet & from ISE however when connecting to the SSID portal fails to ever load. Routing is fine since if I define a static IP in the policy result it loads.

I can also take the full redirect URL and browse on corporate SSID which resolves no issues.

Any thoughts?

[balaji.bandi]

what kind of certs you using?

after connecting, can you try manually access the URL ? (if the redirect failing ?)

what is difference between Corporate SSID and Guest SSID DNS ?

[connor-jaques]

I have a wildcard certificate issued by a public authority on my Guest splash.

Manually I am also unable to access.

Corporate SSID is using internal DNS servers.

Guest SSID is using Google DNS.

AP's have internal DNS since as per this doc it's the AP's which DNS resolve the splash page? - https://documentation.meraki.com/MR/Encryption_and_Authentication/CWA_-_Central_Web_Authentication_with_Cisco_ISE

One thing to note is this is working perfectly fine with my ISE 2.7. The only differences are:

- Radius server in SSID config

- DNS name of the splash page

[balaji.bandi]

Is the portal is FQDN ?  - is the FQDN can be resolved using Google DNS.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216191-troubleshoot-common-cisco-ise-guest-acce.html

[connor-jaques]

The portal does have an FQDN associated to it's IP address yes. The FQDN is resolved from an internal DNS server - the AP has no issues resolving this.

The client can access the portal IP through the Meraki walled garden config.