Wireless WebAuthen using cisco ISE - WLC - AP Flexconnect mode problem redirect

[14521108@gm.uit.edu.vn]

Hello!

I am testing Wireless WebAuthen using Cisco ISE, WLC and AP Flexconnect mode.

My version CIsco ISE is 2.2,WLC is AIR-CTVM-K9 - version is 8.5.103.0, IOS version of AP is 15.3(3)JF

My prolem is i get web authen success from ISE but when  i connect to internet by web browser then my traffict is still  redirected again

I searched a lot ways how to confure Central Web Authentication with WLC, ISE, FlexConnect but i still can not solve this problem.

i forlowed this guide https://cisco-marketing.hosted.jivesoftware.com/servlet/JiveServlet/previewBody/68191-102-1-125118/How-To_14_Universal_WLC_FlexConnect_Config.pdf

Here is logs on my ISE

What can we check to solve the problem?

Thanks a lot in advance.

Kind regards,

[Francesco Molino]

Hi

Can you share a screenshot of your ISE authorization policies?
What's the status of this client on your wlc after being authenticated?

[14521108@gm.uit.edu.vn]

Thanks for your answer
The status of the client on my wlc after being authenticated still
url-redirect, not change
Here is my ISE authorization policies

Thanks

[Francesco Molino]

What do you see in Live logs? Do you see the user getting actually authenticated?

[14521108@gm.uit.edu.vn]

Yes,in live logs i saw my user gets authenticated rule, after that user
traffic matches redirect rule back

[ajc · Accepted solution]

check this link

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html?referring_site=RE&pos=1&page=https://www.cisco.com/c/en/us/support/docs/wireless/flex-7500-series-wireless-controllers/113605-ewa-flex-g...

[ajc]

Please be aware of this:

An issue with FlexConnect APs is that you must create a FlexConnect ACL separate from your normal ACL. This issue is documented in Cisco Bug CSCue68065 and is fixed in Release 7.5.  In WLC 7.5 and later, only a FlexACL is required, and no standard ACL is needed. The WLC expects that the redirect ACL returned by ISE is a normal ACL. However, to ensure it works, you need the same ACL applied as the FlexConnect ACL.

[Francesco Molino]

Ok, thanks for the info. Have you create the ACL Permit you refer to on the flexconnect side?

[14521108@gm.uit.edu.vn]

Yes, I have.

The problem is the normal ACL  doesn't work but Flexconnect ACL works on Access Point.

I think on Cisco ISE, url-redirect-acl is Flexconnect ACL on WLC and Airespace-ACL-Name is normal ACL on WLC.

In my Web_Redirect Authorization Profile, i configured url-redirect-acl is cwa_redirect which is a Flexconnect ACL on WLC, and my user can be rediected to Portal Web Authentication. WirelessPermitAll Authorization Profile, Airespace-ACL-Name is PERMIT_ALL, which is a normal ACL in WLC, normal ACL doesn't work, my user have no permision after authened.

So on WirelessPermitAll Authorization Profile, i didn't use Airespace-ACL-Name, i used url-redirect-acl is Flex_PERMIT_ALL ACL, i means don't redirect, my user can connect to internet. I known it's odd.

When i showed access-list on AP, I only saw Flexconnect ACL.
How do i fixed the problem? How do i make normal ACL of WLC work on
AccesPoint (on Flexconnect mode)?

[ajc]

Did you check this?

The WLC expects that the redirect ACL returned by ISE is a normal ACL. However, to ensure it works, you need the same ACL applied as the FlexConnect ACL

[ajc]

In fact, the guide you used at the beginning mentions the same thing from the link I provided to you about having the EXACT same ACL for redirect (including name) in the WLC ACL and the Flexconnect ACL. I am wondering if you verified this part.

[Francesco Molino]

@abraham is right. Your normal acl and flex acl should have the same name otherwise you'll get in trouble