No redirection to ISE Posture Portal

[abkadour]

Dear community,

I'm configuring the Posture with client provisioning. when the user tries to connect to the network, he is successfully authenticated, but he is not being redirected to redirect URL. when i try to manually enter the URL on different browsers i get the portal to download the anyconnect ressources. here is the DACL that use for the authorization profile : 

# permit udp any eq bootpc any eq bootps

# permit udp any any eq domain

# permit icmp any any

# permit tcp any host < ISE_Node> eq 8443

# permit tcp any host < ISE_Node> eq 8905

# permit udp  any host < ISE_Node> eq 8905

For the Redirect ACL on the switch Catalyst 2960X-15.2.7 : 

# deny udp  any eq bootps any

# deny udp any any eq bootpc

# deny udp any eq bootpc any

# deny udp any any eq domain

# deny udp any host <ISE_Node> eq 9805

# deny tcp any host <ISE_Node> eq 9805

# deny udp any host <ISE_Node> eq 8443

# permit tcp any any eq www

# permit tcp any any eq 443

on the switch , i can see that is applying the DACL and ACL and giving the URL redirect

• Any help please !! 

[Flavio Miranda]

@abkadour 

 Can I see the output of "show license" ?

[abkadour]

i'm actually using an evaluation license

[Flavio Miranda]

Keep in mind that LAN Lite model does not support features like CoA or DACLs

[abkadour]

it's a Catalyst switch 2960X so i suppose its LAN Base model. Can you please give the link to refer to 

[Flavio Miranda]

You can check a similar thread with Cisco reply

https://community.cisco.com/t5/network-access-control/cisco-ise-acl-and-url-redirect-not-showing-in-show-auth-sessions/td-p/4415933

[abkadour]

its WS-C2960X-48FPS-L , its LAN Base model so i think it support DACL and redirection

[abkadour]

are the ACL and Dacl correct ! 

[Flavio Miranda]

Try to deny the port 443 only for ISE

# deny tcp any <ISE> eq 443

Keep the the permit for everything else

permit tcp any any eq 443

[Aref Alsouqi]

"deny udp any host <ISE_Node> eq 8443" this line is wrong and it has to be replaced with "deny tcp any host <ISE_Node> eq 8443", ISE portal runs on port 8443 in TCP not UDP. Try to change that and see if it fixes the issue.