ISE pointing to External Web Server as GUEST Portal

[jmoliner]

Hi all:

One customer wants to have an external WEB Server as Guest Portal.

I mean, customer wants to customise a web server. Then, the ISE will point to this server in order to show the Captive Portal.

IS it supported?

How to achieve that? ISE Version? WLC Version?

Thanks in advance.

Jesús Molinero.

[Charlie Moreton]

You can do this by pointing the Authorization Profile to the external web portal.  Then, using API, you can place the endpoint MAC Address into the proper Endpoint Identity Group and perform a COA.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/api_ref_guide/api_ref_book/ise_api_ref_ers1.html

[Greg Gibbs]

The problem with using this type of static web server is that this is essentially a dead-end flow from the ISE perspective, hence the suggestion to use the REST API for any control of the session after the redirect.

Unless the session state is changed by some external system (like the REST API), the session would be stuck in the URL redirect state. Any comms required in this state would need to be exempted from redirection in the redirect ACL.

If the customer's main concern is customising the look & feel of the Guest portal, a better option would be to look into using the ISE Portal Builder.

[Craig Hyps · Accepted solution]

There is no simple option to say "use this external page for CWA".  The CWA flow completes the auth on the PSN, updates specific session and in some cases endpoint attributes, and triggers needed COA.  Even with APIs, there is no option to say "user completed auth, user accepted API, etc".  You could use API to register endpoint similar to CWA flow and assign Portal User, but auth would be associated with the endpoint (MAB).