problem Wifi guest with cisco ise wlc message: Redirect ACL failure

[neccia paolo]

hello everyone
these days i am experiencing a problem due to Redirect ACL failure message,
below i am releasing the details of my EWLC
EWLC firmware 17.6.4
I checked via wireshark the response received from cisco ise and indeed the connection is accepted also in the response as you can see
i get the message url-redirect-acl=Guest_Redirect
checking the documentation on the internet i found that this error occurs when ACL is malformed as a name or is missing but i have recreated acl several times by copying the name from the cisco ise response.

do you need more information to be of support to me ?

[JPavonM]

Is the ISE response matching your ACL configured in the eWLC? (Guest_Redirect)

[neccia paolo]

this is what the cisco ise answers (captured with wireshark)

and this is what I called acl by copying and pasting from the name returned by cisco ise

thank you very much for the support

[Rich R]

The 17.6.4 software is now badly out of date and almost end of support!
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-6-x-eol.html
If you want to run 17.6.x then you should at least be using 17.6.8 (the last release of 17.6).
Refer to the TAC recommended link below and start planning your migration to a supported release which will have hundreds of bug fixes including for some critical security vulnerabilities.

Check your config with the output of "show tech wireless" using the Config Analyzer (link below) for common mistakes and best practices. (Best Practices link below too)

Review https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html and https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html to make sure you haven't missed anything.

[Saikat Nandy]

Can you share  - 

'show tech wireless' from EWC
'show ip access-list' from one of the APs

[neccia paolo]

Hello Saikat,

First of all, thank you for your support.

Regarding the show ip access-list command executed directly on one of the APs: it does not return any output. However, when I run the same command on the WLC, I can see the full list of created ACLs, including the Guest_Redirect.

As for the show tech wireless output from the EWC: the result is very large. Could you please let me know which specific section or information you would like me to extract?

[Saikat Nandy]

I would like to see the mode of APs + config. You can upload a notepad with the show tech wireless output here.

[Rich R]

@neccia paolo EWC only supports flexconnect local switching so ACLs applied to client traffic have to be implemented on the AP.  
The fact that you aren't seeing the ACLs suggests your config is wrong - see https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html#toc-hId--2047927279 and https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html#toc-hId-814074466

Paste the output from show tech wireless into a text file (.txt) on any text editor like Notepad and then attach the file here.

[neccia paolo]

Hi Rich R,
I believe we have found the error point, that is, my APs are in flex mode. I have created the flex profile as recommended in the guide, but how can I associate it with the profile or the WLAN? At the moment, after modifying the configuration, I receive an ACl Failure error.

As soon as I have the opportunity, I will share the file.

Thank you again.

[Rich R]

The Flex Profile is linked to the site tag.
It's clearly explained in the document I already linked in my previous reply:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html#toc-hId-206864907

[neccia paolo]

Hi Rich R
thank you so much your help has been really helpful,
I receive the authentication page the acl is associated,
I made an acl permet any any but I can't access the page
sniffing the packets I only detect DNS traffic strangely no HTTP traffic
I checked the DNS queries and it actually returns the IP of the cisco ise.

I see the client coming

keep in mind that my ACL is set to permit any any ip

Thanks again for the support

[Rich R · Accepted solution]

I guess you mean permit ip any any ...
For a redirect ACL that is an absolute NO, NO, NO because not all traffic must be redirected!
Please read the guide slowly and carefully and follow the examples. The redirect ACL should only be redirecting client captive portal detection traffic (http, TCP port 80), and excepting traffic to the ISE itself, DNS, DHCP, NTP. 

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html#toc-hId-881505252

[neccia paolo]

Thanks fo all support @Rich R  now working you are my hero,
only the las qquestion you thinks is possible setting same configuration for the mobility express wlc ?

thanks again !!!!

[Rich R]

You're welcome.

According to Table 15 and 16 at https://www.cisco.com/c/en/us/td/docs/wireless/access_point/feature-matrix/ap-feature-matrix.html it should also be supported on ME.

For AireOS see:
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71881-ext-web-auth-wlc.html
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/115951-web-auth-wlc-guide-00.html