9800-CL CWA ClearPass Connected/No Internet

[JG1808]

I'm facing issues with no internet after I access ClearPass Self-Registration CWA.  The self-registration only asks for name and email.  I'm able to ping/resolve external hostnames, but unable to browse.  Has anyone seen this issue on either ClearPass or ISE?  My ACLs are below.

Flex Profile Policy ACL
Extended IP access list CAPTIVE_PORTAL_REDIRECT
1 deny ip any host 10.6.1.12 (9 matches)
2 deny ip host 10.6.1.12 any
3 deny udp any any eq domain
4 deny udp any eq domain any log
5 deny icmp any any log (74 matches)
6 permit tcp any any eq www (2632 matches)

Flex Profile VLAN ACL-egress
Extended IP access list acl-internet-only
10 permit udp any eq bootpc any
20 permit udp any eq bootps any
30 permit udp any any eq domain
40 permit tcp any any eq domain
50 deny ip 10.85.2.64 0.0.0.63 172.16.0.0 0.0.15.255
60 deny ip 10.85.2.64 0.0.0.63 192.168.0.0 0.0.0.255
70 deny ip 10.85.2.64 0.0.0.63 10.0.0.0 0.255.255.255
80 permit ip any any

Thanks in d

[MHM Cisco World]

 permit udp any eq bootpc any
20 permit udp any eq bootps any
30 permit udp any any eq domain
40 permit tcp any any eq domain

For domain you need to specify two way ACL' i.e. 

Permit any any eq domain 

Permit any eq domain any 

For dhcp I think bootpc/bootps need to adjust also' i.e. keep notice source and destiantion of traffic 

MHM

[Rich R]

Have you followed the guide?
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217931-configure-9800-wlc-and-aruba-clearpass.html

Post-auth problems are usually due to WLC not receiving the CoA correctly.  Have you got that configured correctly and confirmed the WLC receives the CoA after the user logs in?