cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
332
Views
0
Helpful
2
Replies
Highlighted

Web Authentication via ISE in CWA

Hi,

I have setup a SSID "GUEST" which will use web authentication, and i have followed Cisco's CWA document right down to the last step. However, wen i authenticate via Guest portal on ISE i get full access to the network i.e. even the core switches and all, but i just want to give access to the internet. Is this possible? I have tried using the auth acl but to no avail. Tried the authorization profile but still full access to the internet.

P.S : I dont want to create a seperate VLAN for guest and which has access only to the internet.

Regards,

Usama

2 REPLIES 2

Web Authentication via ISE in CWA

Well honestly....adding a VLAN dedicated for guests and ACL it from the rest of the network would be the best practice, IMHO.

Other than that, you would need to create an ACL on the WLC, and assign that to the user when the logged in via ISE. Though I'm not sure you could return that attribute without doing 802.1x

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

HTH, Steve ------------------------------------------------------------------------------------------------ Please remember to rate useful posts, and mark questions as answered

Web Authentication via ISE in CWA

Hi,

Thanks for your reply. Yeh i know tht is the way to go but I want to see what can be done with ISE. See with CWA setup we use the NAC Radius mode and tht accepts CoA but is there any attribute in it tht can be returned that allows this? Furthermore, how do we do it with 802.1x?

Thanks

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards