Wireless Hotspot for guest with ISE2.6 is failing

[sushanta.behera22]

Hi guys,

As part of POC , I started working to setup wireless Hotspot for guest on WLC 5520  code 8.5.161.0 integrated with our DEV ISE2.6 for webpage redirection and authentication & authorization. I followed all the cisco recommended steps and setup is completed (not sure if I missed any small thing) however clients not able to join to this new SSID called - PublicWiFi. 

Issues:

clients are not getting DHCP ip address nor getting redirected to login page.

I tried to create DHCP pool on direct core switch and even in local DHCP server however both are failing. And also there is no Radius live logs. But I captured debug logs from wlc and attached here.

steps I did:

- created new SSID - PublicWiFi, new interface publicwifi  with new subnet, ISE IP address configured as radius server

- created new vlan, SVI , DHCP scope created on DHCP server

-2 ACL configured on wlc , one for redirect and second for internet access & block internal subnets

- In ISE , created hotspot guest portal, associated end-point group. authorization profile and authentication  policy under policy set

I will attach here all screen shot from my WLC and ISE server. Please verify it and ask me if you need any more information.

Thanks,

Sushant

[Rasika Nayanajith]

If you simply make it open SSID, will the client get an IP address? I would start from there.

Hope you are following something like below

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475 

HTH

Rasika

*** Pls rate all useful responses ***

[sushanta.behera22]

Hi Rasika,

I changed the L2 security as  none and uncheck MAC filtering , client able to connect to the open SSID and can access to the internet without any issues. yes Im following up that links and setup done in both WLC and ISE same way.  I changed back to MAC filtering on and NAC state as ISE NAC  .. this time client not able to connect to SSID. 

Thanks,

Sushant

[patoberli]

Not sure if you need MAC filtering on the WLC for this.
Besides that, make sure your pre-authentication ACL allows the DHCP packets.