ISE 1.3 SEND 'CoA' BUT SWITCH IS UNABLE TO REDIRECT THE URL IN TO CLIENT BROWSER

[Jarismuneer]

I HAVE CONFIGURES THE ISE AUTHORIZATION FOR GUEST "CWA".

WHEN THE GUEST TRY TO ACESS THE NETWORK ISE SENDS THE URL TO MY SWITCH 2960-S. 

I CAN SEE THE LINK  BY ISSUING THE COMMAND

SHOW AUTHENTICATION SEESION INTERFACE GI 1/0/14

BUT THE CLIENT BROWSER CANT GET THE LINK.........

[Maiquel Consalter]

Check you ACL_REDIRECT in Switch. Verify the DNS (FQDN) in guest portal. 

[Jarismuneer]

You can see DACL 

before and after CoA

i have also configure the ISE with static IP but 

still client is unable to redirect the link to guest portal

[Maiquel Consalter]

Can you post the ACL-WEBAUTH-REDIRECT ? 

Try too, enable the IP Renewal in guest portal is optional. 

Enable the IP Renewal (Optional)

If you assign a VLAN, the final step is for the client PC to renew its IP address. This step is achieved by the guest portal for Windows clients. If you did not set a VLAN for the 2nd AUTH rule earlier, you can skip this step.

If you assigned a VLAN, complete these steps in order to enable IP renewal:

1. Click Administration, and click Guest Management.
2. Click Settings.
3. Expand Guest, and expand Multi-Portal Configuration.
4. Click DefaultGuestPortal or the name of a custom portal you may have created.
5. Click the Vlan DHCP Releasecheck box.

[Jarismuneer]

ip access-list extended ACL-WEBAUTH-REDIRECT
permit tcp any any eq www
permit tcp any any eq 443
deny ip any any

After CoA i copy the link of web auth from the switch and past it into the client browser, it will open the web page for guest, after entering the credentials it work fine.

[Maiquel Consalter]

try this:

ip access-list extended redirect
deny ip any host <ISE ip address>
permit TCP any any eq www
permit TCP any any eq 443

[Marvin Rhoads]

Do you have the "ip http server" command enabled on the switch?

Is the client browsing to an http (not https) site?

[Jarismuneer]

yes both  "ip http server" &" ip http secure-server"  is configured