web redirection ACL (deny or permit)

[ivan.yeung]

Hi all,

i looked two cisco web page describing web redirection ACL, however, seems they are total different? or am i missing something? or configuration of redirection  ACL total different on ISE and WLC?

1)

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

The final step is to create a redirect ACL. This ACL is referenced in the access-accept of the ISE and defines what traffic should be redirected (denied by the ACL) and what traffic should not be redirected (permitted by the ACL). Here you just prevent from redirection traffic towards the ISE. You might want to be more specific and only prevent traffic to/from the ISE on port 8443 (guest portal), but still redirect if a user tries to access the ISE on port 80/443.

2)

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html

For the redirection ACL, think of denying action as a deny redirection (not deny traffic), and permit action as permit redirection. The WLC will only look into traffic that it can redirect (port 80 and 443 by default).

[Mohammed al Baqari · Accepted solution]

Hi,

You are looking at configs for two different controllers and their ACLs
operate in opposite ways. AirOS WLCs are different from IOS-XE WLCs. Hope
that helps.

So if you are using 9800 WLCs, deny will not redirect.
If you are using 3504 (for example), deny will redirect.


**** please remember to rate useful posts