@mmalwatte - that still happens in ISE 2.4 occasionally.  In fairness, I have only done the 'URL Test' function so far.  But I have also wondered about the robustness of this JQuery logic.  I have seen cases where the login page is displayed permanently. If you don't remvove the Cancel button, then you're giving the users a route back to the Login page - this is why I wanted to hide that button. ... View more

Hi @Jason Kunst and @Anthony Poli    The contents that follow the "sessionId=" string in the URL is constructed from the Java Script code   var WebSessionId = window.location.href.substr(window.location.href.search("\\?")).split("=")[2];   The problem was that the split() method was trying to return the 3rd list element (indicated by the [2]) - in my case the string was  '?portal=b0e5fdc2-786a-11e9-be7d-1e314c3100f5' If you split by '=' delimiter There is no 3rd list member ;-0   So the syntax should be    var WebSessionId = window.location.href.substr(window.location.href.search("\\?")).split("=")[1];   that works - a nice way to test ...   ... View more

Hi @Anthony Poli    This is excellent stuff and just what I am after. I tried this on ISE 2.4 and I am struggling to populate the WebSessionId. The code says  var WebSessionId = window.location.href.substr(window.location.href.search("\\?")).split("=")[2];   The Firefox debugger tells me that window.location.href = "https://192.168.0.221:8443/portal/PortalSetup.action?portal=efe1f422-786a-11e9-be7d-1e314c3100f5" But the WebSessionId is "undefined" This is what I get when I hover over the new button that is created: https://192.168.0.221:8443/portal/PortalSetup.action?portal=b0e5fdc2-786a-11e9-be7d-1e314c3100f5&sessionId=undefined&action=cwa   Any ideas?   I have two portals Patient Portal https://192.168.0.221:8443/portal/PortalSetup.action?portal=b0e5fdc2-786a-11e9-be7d-1e314c3100f5 Resident Portal https://192.168.0.221:8443/portal/PortalSetup.action?portal=fbdb4ab2-786a-11e9-be7d-1e314c3100f5   The code that I put  into the Hotspot Portal Optional 1 is   <script> jQuery(window).ready(function() { var hostname = window.location.hostname; var WebSessionId = window.location.href.substr(window.location.href.search("\\?")).split("=")[2]; jQuery('.cisco-ise-body').append(' <center><a href="https://192.168.0.221:8443/portal/PortalSetup.action?portal=b0e5fdc2-786a-11e9-be7d-1e314c3100f5&sessionId='+WebSessionId+'&action=cwa" style="color: rgb(0,255,0)"><font color="212121"><button type="submit">Patient Portal</button></font></a></center>'); }); </script> <script> jQuery(window).ready(function() { var hostname = window.location.hostname; var WebSessionId = window.location.href.substr(window.location.href.search("\\?")).split("=")[2]; jQuery('.cisco-ise-body').append(' <center><a href="https://192.168.0.221:8443/portal/PortalSetup.action?portal=fbdb4ab2-786a-11e9-be7d-1e314c3100f5&sessionId='+WebSessionId+'&action=cwa" style="color: rgb(0,255,0)"><font color="212121"><button type="submit">Residents Portal</button></font></a></center>'); }); </script>   ... View more

iPSK behaviour is identical to PSK, except that the WLC does a quick check with the Radius Server (can be ISE or anything else) whether there is a custom PSK or not.  If the MAC address is not found on the Radius Server, then the Radius Server can do one of two things - send a Reject to WLC and client won't connect.  This is strict mode - in other words, if your MAC address is not on the Radius Server then I don't care what PSK your client has, I will refuse to accept you. - send an Accept to the WLC and then the client PSK and WLAN PSK have to match.  I call this the "compatibility mode" - it's great in deployments where you want to be non-disruptive with the existing clients whose MAC address you may never want to have controlled by the Radius Server.  It gives you control over which clients you want to control using iPSK (create groups of devices that have their own PSK)   Failing that - if you want plug and play then perhaps MAB or 802.1X is the other option.  But that comes with its own headaches.   There is no free lunch ... ... View more

I would recommend using Smart Conditions that are built into ISE when creating Wireless MAB policy sets. Make that the first step. Allowed Protocols should only have First checkbox ticked (hosts). Not PAP etc - in your screenshots it shows that a PAP request came in. If you use Allowed Protocls correctly then it will catch this type of thing early on.  The authentication rule will be simple then. Use default “internal endpoints” and set to Continue if user not found.  Authorisation should the make tests about which identity group the user belongs to etc  ... View more

Not seen that before when importing any cert into ISE. What does the exported cert look like in a text editor? I think ISE exports in PEM format and so you should see the BEGIN CERTIFICATE text etc. Maybe something doesn’t look right in that file? Are you able to import any other cert like a root ca cert (just as an example )?   what you’re doing by importing the pan 2 cert into pan 1 is technically feasible but it’s not ideal. Self signed certs are no basis to build a long term system. It doesn’t scale. It brings browser warnings. Renewing these things is a pain. If you can issue an ISE Admin cert via some PKI or via a public ca the i would advise you do that. That’s just an aside ... what you’re attempting should however not result in an error. Ise 2.3 is not famous for its quality either ... View more