Web Authentication via ISE in CWA

[Usama Waheed Khan]

Hi,

I have setup a SSID "GUEST" which will use web authentication, and i have followed Cisco's CWA document right down to the last step. However, wen i authenticate via Guest portal on ISE i get full access to the network i.e. even the core switches and all, but i just want to give access to the internet. Is this possible? I have tried using the auth acl but to no avail. Tried the authorization profile but still full access to the internet.

P.S : I dont want to create a seperate VLAN for guest and which has access only to the internet.

Regards,

Usama

[Stephen Rodriguez]

Well honestly....adding a VLAN dedicated for guests and ACL it from the rest of the network would be the best practice, IMHO.

Other than that, you would need to create an ACL on the WLC, and assign that to the user when the logged in via ISE. Though I'm not sure you could return that attribute without doing 802.1x

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

[Usama Waheed Khan]

Hi,

Thanks for your reply. Yeh i know tht is the way to go but I want to see what can be done with ISE. See with CWA setup we use the NAC Radius mode and tht accepts CoA but is there any attribute in it tht can be returned that allows this? Furthermore, how do we do it with 802.1x?

Thanks