I'm testing a pair of 5760s for a near-term production rollout. I have the dot1x employee wlan working, but am having trouble with the guest web-auth wlan. We have a foreign controller with connected APs and an anchor controller in the DMZ. We're using an external redirect to the ISE guest portal. ISE is working with our production equipment and hasn't been changed. However, I'm not able to get an IP address assignment to test the ISE redirect. When I remove all of the web-auth configuration, I'm getting an IP address without issues. My configuration is attached below, and would appreciate an extra set of eyes.
!!!!!!!!!!!!
!! Anchor controller
!!!!!!!!!!!!
!
aaa group server radius ISE
server name iseservername
aaa authentication login ISE-MethodList group ISE
!
parameter-map type webauth global
type webauth
virtual-ip ipv4 x.x.127.1 virtual-host guest-redirect.domain.com
!
parameter-map type webauth Guest-param-map
type webauth
redirect for-login https://guestportal.domain.com:8443/guestportal/portal.jsp
redirect portal ipv4 x.x.164.35
!
ip access-list extended Guest-preauth
permit udp any any eq domain
permit udp any eq domain any
permit udp any any range bootps bootpc
permit tcp any any eq 8443
permit tcp any any established
ip access-list extended Guest-redirect-acl
permit tcp any any eq www
!
radius server iseservername
address ipv4 x.x.164.35 auth-port 1812 acct-port 1813
key [verysecretkey]
!
wlan Guest 1 Guest
client vlan 330
ip access-group web Guest-preauth
mobility anchor
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
security web-auth
security web-auth authentication-list ISE-MethodList
security web-auth parameter-map Guest-param-map
no shutdown
!!!!!!!!!!!!!!!!
!! Foreign Controller
!!!!!!!!!!!!!!!!
wireless management interface Vlan60
!
wlan Guest 1 Guest 1
client vlan 60
mobility anchor x.x.60.160
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
security web-auth
no shutdown
