browser won't pop up during cisco guest portal

[seanxiao]

GREETINGS all,

We  suddenly have an issue that guest user cannot complete the guest portal authentication because the browser cannot pop up.

From the ISE live log:

1. device authentication successful;
2. device get the configured IP address  (a guest VLAN);
3. device can communicate with the guest DNS server with the assigned guest IP
4. device hit the desired authentication policy and authorization policy

but the device cannot access guest portal even we manually input the URL , neither can the device access Internet. Please see the log as below:

Result

User-Name	10-A5-1D-09-30-2B
Class	CACS:0af0c5080006598267e0c924:ZJK-SVAP-PSN01/524332189/308487
cisco-av-pair	url-redirect-acl=ACL_WEBAUTH_REDIRECT
cisco-av-pair	url-redirect=https://guestportal3.int.my-domain.com:8450/portal/gateway?sessionId=0af0c5080006598267e0c924&portal=021ff832-a158-4e12-be34-edf81c2d8efe&action=cwa&token=b9593114317c8774158992fe0c5c9796
cisco-av-pair	profile-name=Intel-Device
LicenseTypes	Essential license consumed.

Session Events

2025-03-24 02:53:30.028	RADIUS Accounting start request
2025-03-24 02:53:24.858	Authentication succeeded

Event	5200 Authentication succeeded
Username	Device-mac-address
Endpoint Id	Device-mac-address
Calling Station Id	Device-mac-address
Endpoint Profile	Intel-Device
Identity Group	Profiled
Audit Session Id	0af0c5080006598267e0c924
Authentication Method	mab
Authentication Protocol	Lookup
Service Type	Call Check
Network Device	wlc-name
Device Type	All Device Types#WLC
Location	All Locations#my-location
NAS IPv4 Address	My-WLC-IP-address
NAS Port Type	Wireless - IEEE 802.11
Authorization Profile	Cisco_WebAuth_ZJK
Response Time	58 milliseconds

Other Attributes

ConfigVersionId	141
DestinationPort	1812
Protocol	Radius
NAS-Port	13
Framed-MTU	1300
Acct-Session-Id	67e0c924/10:a5:1d:09:30:2b/485408
Tunnel-Type	(tag=0) VLAN
Tunnel-Medium-Type	(tag=0) 802
OriginalUserName	10a51d09302b
NetworkDeviceProfileId	b0699505-3150-4215-a80e-6753d45bf56c
IsThirdPartyDeviceFlow	false
AcsSessionID	ZJK-SVAP-PSN01/524332189/308487
SelectedAuthenticationIdentityStores	Internal Users
AuthenticationStatus	UnknownUser
IdentityPolicyMatchedRule	MAB
AuthorizationPolicyMatchedRule	Aurobay-Guest Redirect
EndPointMACAddress	device-mac-address
ISEPolicySetName	policy-set-name
IdentitySelectionMatchedRule	MAB
TotalAuthenLatency	58
ClientLatency	0
DTLSSupport	Unknown
HostIdentityGroup	Endpoint Identity Groups:Profiled
Network Device Profile	Cisco
Location	Location#All Locations#my-location
Device Type	Device Type#All Device Types#WLC
IPSEC	IPSEC#Is IPSEC Device#No
RADIUS Username	Device-mac-address
NAS-Identifier	WLC-Name
Device IP Address	WLC-IP
CPMSessionID	0af0c5080006598267e0c924
Called-Station-ID	2c-33-11-ba-78-00:SSID-NAME
CiscoAVPair	audit-session-id=0af0c5080006598267e0c924
UseCase	Host Lookup

[Rich R]

> the device cannot access guest portal even we manually input the URL
What exactly happens?  Do you get an error message? Does it timeout?
Did you enable browser network trace to see what that shows?
Did you do a packet capture to see what that shows?
Are you using a valid public certificate for guestportal3.int.my-domain.com which is trusted by the client OS and browser?
Are you sure the certificate has not expired?

[seanxiao]

thanks for your reply

now the browser pops up, and the DNS works when we do nslookup www.google.com [DNS_For_Guest]

now the issue is that the end device can get IP from the guest VLAN, but cannot access any network resource, even cannot ping its guest VLAN gateway. When I do ping gateway from the device, all is time out. If I ping from where the gateway is residing (fortigate), it just showing icmp echo request, but never got a reply.

[Scott Fella]

Just to confirm, This exact configuration was working previously and now "SUDDENLY ALL" guest devices are no longer working?  So no matter if its an iPhone, Android, Windows or Mac, you are seeing the same issue?  If this is the case, I would think something has changed that broke this.

[seanxiao]

thanks for your reply

now the browser pops up, and the DNS works when we do nslookup www.google.com [DNS_For_Guest]

now the issue is that the end device can get IP from the guest VLAN, but cannot access any network resource, even cannot ping its guest VLAN gateway. When I do ping gateway from the device, all is time out. If I ping from where the gateway is residing (fortigate), it just showing icmp echo request, but never got a reply.

[srimal99]

have you check correct ip given from the dhcp pool and ise authz rules set up correctly ( Any override  Vlans configured ) . Check the log on the ise and switch port. If you accessing via Guest SSID why do you need access to network devices ? is you ssid set up for DMZ zone ?Check the Guess portal access-list if you have block icmp .