ISE Captive portal doesnt load

[Patxi]

The scenario is WLC 9800 + ISE v2-0-0-306 with patch 2,8.

When some device tries to connect to the guest SSID, I see the request is falling in the right rule at ISEs policies. And the result is:

Attributes Details
Service Template	false
Access Type	ACCESS_ACCEPT
Centralized Web Authentication	ACL=ACL-REDIRECT (https://192.168.1.50:port/portal/gateway?sessionId=SessionIdValue&portal=36393970-c9bd-11e5-b568-58ac785caa4f&action=cwa)

But the web doenst load and the device gets full access. 

¿Any idea why the web portal doesnt load?

[Tariq Mahmoud]

The device not reaching the web portal could be due to multiple reasons:
1. Wrong DNS configuration. 
2. Wrong redirect ACL/URL settings on ISE and the wireless controller. 
3. Wrong authentication result from ISE. 

Check this guide for more details:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html


If the device is getting full access, then it could be matching a different rule on ISE. 
I suggest having a look at both ISE detailed live logs and client captures.