Hi guys,
I'm new to ISE and recently we are deploying ISE to production to authenticate users. The issue currently encountered is guest self-registration. For security reasons, the network where the guest is located is a separate area on the firewall, when a guest accesses the network, ISE will deliver a redirect URL for the visitor to self-register. ISE is able to deliver the redirect URL and call the ACL to the interface, but the client does not automatically pop up the browser and redirect to the self-registration page, and redirects cannot be triggered by manual access a website either, but copying the redirect URL delivered by ISE to the switch interface to the client is accessible .(There is a policy on the firewall to allow the switch to manage the IP to the guest network.). I checked the forums and found that the firewall might be blocking the one-way traffic from spoofed IP to client VLAN. With the same configuration, if I modify the vlan-id delivered by ISE to the SVI which is on the core switch, it is no problem at all. So I believe it's the firewall that implicitly blocks this traffic. Has anyone ever been in this situation? How should it be resolved?
1. I enabled a guest SVI on the authentication switch as suggested on the forum and it works.
2. Someone suggested enabling redirects for L2, but I don't know how to do it and don't know if it works.
