ISE 2.3 and Cisco WebAuth not working

[ben.posner]

anyone else here got a 2.3 install running? i cannot get my guest setup working. we updated from 2.2 to 2.3 and i had to recreate the whole policy set but got it all working again in the end with the exception of the guest wifi rules. but the thing is even the DEFAULT captive web auth doesn't seem to be working either.

so i setup a lab with a fresh 2.3 install connecting to a lab WLC. i can get a user to connect to the SSID but they NEVER get redirected to the PSN for login to the guest portal. they just get full access and go right out to the web with no login at all. live logs show the user's system connecting and getting throw into the Wifi_Redirect to Guest Login authZ policy but they never get any prompts! and like i said this is happening on our new 2.3 install and on a FRESH, out of the box 2.3 LAB setup.

[zalkurdi]

Hello Ben,

So from what you are saying, if you open a browser and go to http://8.8.8.8, you are not redirected to the portal, correct?

Once you authenticate the user, what do you see in the authentication report on the ISE? Are you sure that ISE is pushing the redirect ACL and URL?

If so, you can go to the WLC client page, open the MAC address of the client and check whether the URL and ACL are visibile there. The state of the client should be  You need to make sure that the ACL is permitting traffic to the ISE nodes, DNS and DHCP but denying all HTTP traffic. This lets the WLC know that HTTP traffic should be redirected.

If all this is confirmed, try to run a packet capture on the PC to see if it is receiving the redirect URL from the WLC.

Hope this helps.

Regards,

Zaid Kurdi

[ben.posner · Accepted solution]

So i found a few issues with my setup.

1) i forgot to enable Radius NAC for the two SSIDs i had been testing with. that was a major break through.

2) because i was using an Anchored WLC setup i also had to have the redirection url applied on the anchor WLC which explains why we weren't seeing any of the hit counters on the main WLC.

once i got both of those squared away and setup a guest account to test with it was in business.

[zalkurdi]

Glad to hear it. Enjoy.