Apple Devices ISE GUEST REDIRECT

Dears,
All our devices connecting to corporate SSID and Guest SSID
when connecting to Guest SSID all devices connect and been redirected to ISE Guert portal
BUT APPLE devices just stays on loading page to Ise server page for guest portal and nothing happens
i used
config network captive bypass command and reboot it doesnt help

You need to do a bit more testing. What I would do is create a new WLAN for testing using the internal auth portal and define the WLAN the same as your guest with the exception of radius, aaa override and radius nac. Have user use that and your self use that on your phone and see if you have to login every so often. Right now, every hour the users device goes to sleep (iOS especially), they would need to login again. Maybe your aaa is overwriting the timer or something else, that's why testing with a different wlan will help you understand if it's a radius, WLC, or maybe device issues. You only have one WLC so roaming shouldn't break this
-Scott

Similar Messages

Guest Anchor - Web Passthrough - Apple device web redirect issue

Hi All,
I've setup a Guest Mobility Anchor at DMZ with 5508 WLC. I've setup the EoIP mobility tunnel and everything works so far.
Now, I was testing multiple clients to connect to the Guest SSID and observed that Apple devices are not redirecting url, resulting unsuccessful connection.
I looked Cisco docs and added the command "config network web-auth captive-bypass enable" on the Anchor as recommended.
Even after executing the command, I'm still facing web redirect issue with Apple Devices. I don't have any issues with other devices, except Apple.
My controller running code AirOS 7.6.130.0. I'm using DMZ controller as DHCP server for Guests and public DNS servers as 8.8.8.8 & 8.8.4.4
How to solve this web redirect issue? Will a Third-party generated CSR solves the problem?
Thanks,
CJ

Hi All,
The issue was with WISPr Protocol with iOS Clients. After upgrading the AirOS Code on the controller to 8.0.100.0; the issue with Web Redirect is resolved.
Jagan

ISE Guest Portal only redirect HTTPS traffic.

I have a wireless deployment consisting of the following:
5760 WLC & ISE 1.2
Am I missing something here
I have 4 similar deployments, and never had these issues:
On Android / Apple devices, the guest portal does not pop up automatically &
On a Windows Laptop only https traffic directs to the guest portal.
Thanx

i think you need to recheck the configuration also check the link for step by step config
http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-security/landing_DesignZone_TrustSec.html

ISE CWA redirection problem for Apple devices

Hi,
I'm testing some guest scenarios (CWA) in my lab using ISE1.3 and WLC2504 (7.6.130).
I have noticed that redirection to ISE portal doesn't work for apple devices (iOS 7 and later).All other devices like laptops,androids etc work fine.
Seems that the workaround on WLC that bypasses the CNA on iDevices doesn't work in my case.The device tries to open the ISE portal and shows just a blank page (attached photo)
The problem doesn't appear for devices with iOS 6 but only for newer versions.
I've also tried with version 8.0 on WLC without success.
Any advise?
Regards.

Captive portal/wispr support for apple ios7
CSCuj18674
Description
Symptom:
When attempting to access the Guest Portal with an Apple iOS 7 device while the WLC "Captive Portal Bypass" feature is enabled, the web sheet on the device still appears, preventing the user from continuing the flow.
Conditions:
The Apple device is running Apple iOS 7.
Workaround:
In the ACL on the WLC used for captive portal redirection and exemption of special traffic for the Guest Portal, add exemptions for the IP resources that resolve from "www.appleiphonecell.com" and "captive.apple.com" FQDNs.
IMPORTANT NOTE: These IP addresses are associated with the FQDNs of "www.appleiphonecell.com" and "captive.apple.com" and are subject to change by the entities hosting those domains. If the IP addresses do change, the ACL would need to reflect that.

ISE 1.3 laptop wireless connection issue & apple devices

hi all,
i am configuring ISE 1.3 with wireless lan controller 2504 with 7.4.121 version.
i am using EAP-tls method of authentication . my certificate server everything working fine. i have one issue which is that i am trying to connect from my laptop i am getting the following error
"The server "ISE.example.local" presented a valid certificate issued by "DC-CA", but "DC-CA" is not configured as a valid trust anchor for this profile. Further, the server "ISE.example.local" is not configured as a valid NPS server to connect to for this profile"
but still i am able to connect and my profiling is working fine, but other laptops when i try to connect i am not getting any this kind of error . it directly says connection cannot connect.
is this problem of certificate on the ISE or the laptop issue , the laptops are not in domain.
even in the apple devices also when we put AD authentication it is accepting after that when we open the browser it is not going to the guest portal it saying some apple captiva portal some thing like that.
please let me know anybody faced this issue?? what is the cause and solution.

Dear, Freerk.
Thank you for your information.
I'd like to try captive bypass function then look at the traffic flow to understand very well, however, it looks like required reboot the controller.
ours is not able to do rebooting process so that, only the choice will be I must search testing result by my self... if you have a result from your lab, could you share with me?
Result message after enable captive bypassing configuration.
(Cisco Controller) config>network web-auth captive-bypass enable
Web-auth support for Captive-Bypass will be enabled.
You must reset system for this setting to take effect.

ISE profiling on Apple-Device, Apple-iPhone and Apple-iPad

hi,
I have a question on ISE profiling, espcially on Apple-device.
My testing environment: when i use iphone to connect, by default the result profiled me as apple-device.
But when i try to get it more specific, i mark the identity store as apple-iphone on the authorization rule, it fail somehow. It seem it cannot go deeper to analyze it's iphone, instead of Apple-Device.
The default of the apple-iphone porfiler condition for apple-iphone is checking the hostname and user-agent. So when i try to use the safari browser to get online, it won't bounce me as apple-iphone profile somehow..
Question:
01. what should i do in order the profiler can analyze directly it was the apple-iPhone, or any thing need to configure ? say like authorization rule?
Thanks
Noel

Are you getting redirected to the web portal in ISE? That is the most common way the ISE can get the user agent of the browser in order to profile the device as the apple-iphone. Give that a try and then see if the user agent is learned, you should get a message to refresh your browser momentarily. Then coa should trigger and the wireless controller should get the new authorization profile that you configured for your apple-iphone endpoints.
Thanks
tarik Admani

ISE 1.1 and Apple devices

I am trying to setup profiling for Apple devices, specifically iPad devices and am seeing where ISE will identitfy an iPad 1 device fine, but will not identity an iPad 2 nor an iPad 3, both list as unknown. It also shows an iPhone as Apple-Device and thats has far as it gets.
The Profiling Policies are all set to Create Matching identity Group and I havent messed with any of the Profiling rules. As anyone seen this before?
Thanks

FYI
With ISE Release 1.2*, Cisco is delivering, a unique feed service that provides new and updated profiles for various IP enabled devices when vendors release new devices. So ISE customers will be able to recognize new devices, in addition to a multitude of other network attached devices such as printers, video cameras, and specialized mobile computing devices.
Cisco works with various vendors, partners, customers, etc. to profile the multitude of IP enabled devices that are expected to be deployed in various customer environments and create profiles for these. These profiles are made available through the Cisco Feed Service. An ISE server* that is configured to connect to the Feed Service establishes a secure connection with cloud based Feed Service. The various profiles on the Feed Service are then automatically downloaded to the ISE server, thus providing ISE customers the ability to stay abreast and detect various IP enabled devices that connect to their network. The Feed Service will be available with the release of ISE 1.2* software release and is part of the Advanced License.

ISE Guest Access- Redirect to URL after successful logon

Currently, when guest users attempt to browse they get redirected to the guest portal. After login, they get a message that they can now access the original URL. Is there a way to automatically redirect to the URL they were trying to access, or remember the URL after they login?

ISE guest flow :
The user associates to the web authentication Service Set Identifier (SSID).
The user opens the browser.
The WLC redirects to the guest portal (such as ISE or NGS) as soon as a URL is entered.
The user authenticates on the portal.
The guest portal redirects back to the WLC with the credentials entered.
The WLC authenticates the guest user via RADIUS.
The WLC redirects back to the original URL

Configuration Profile for Apple Devices with ISE

Hi,
is there any possibility to put configuration profiles on apple device with the ise? I need to disable the dataroaming function in forgein countries for ipads.
Best regards
Felix

Nice. Only trouble there seems to be multiple entry for same mac address there for same resource id.
So when I try to get them as substring i get multiple copies of same mac address.
But looks like this will work as solution to this problem.
So far I was doing it this way (And i am sure there is clearer way to do it.)
SUBSTRING((SELECT ',' + CAST(t2.MACAddress0 AS VARCHAR(40))
            FROM (SELECT DISTINCT ResourceID, MACAddress0 FROM v_GS_NETWORK_ADAPTER) t2
            WHERE t2.ResourceID = ResourceID
            ORDER BY t2.ResourceID, t2.MACAddress0
            FOR XML PATH ('')
        ), 2, 100) [MACAddresses]

OSX 10.10.1 with Cisco ISE guest portal using (CWA) central web authentication issue

We have Cisco Wireless with ISE (Identity Service Engine) to provide guest access with CWA (central web authentication). The idea is to provide guest access with open authentication, so anyone can connect. Then when the guest trying to browse the internet it will be redirected to guest protal for authentication. So only corporate guest with valid password can pass the portal authentication. This is been working fine for windows machine, android, and apple devices with earlier OS version (working on OSX 10.8.5). For clients that's been upgraded to OSX 10.10.1 or IOS 8 they can no longer load the CWA redirection page.
Please let us know if there's any setting under the OSX to solve the issue, or plan from apple to fix the issue on the next OSX/IOS release ?
thanks - ciscosx

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

Aironet 1140 FLEXCONNECT External Web Authentication and Apple Devices

Hi!
I'm having an issue with this Access Point.
I've configured this access point with WLC in mode FlexConnect with web authentication.
It's all right, i'm connecting with my PC in wireless, i open my web browser in windows, then the Access Point redirect me to External Web Authentication Page,
i put my credentials, and i'm redirected to my access point ( https:/1.1.1.1/login.html i accept the certificate) and then the Access Point redirect me to Internet.
I do this with my android phone, it's all right again.
I try to connect with iphone or ipad , i'm redirected to External Web Authentication Page, i put my credentials, and i'm redirected to https://1.1.1.1/login.html where the web browser don't ask me anything and i'm not redirected to Internet.
Have you any idea?

Thx you Scott, i understand what are you talking about, but my problem is different.
I try to explain..
I see the wireless network, i associate the iphone to this network, so i'm redirected to Login page,
as i use the "Apple Login" or i Open a Web Page .
In this page , that i reach with all devices i put my credentials, then i will be redirected with all devices
back to Access Point (https://1.1.1.1/login.html).
In this page i should be redirected to internet after Radius Authentication, but with Apple Devices this doesn't work.
This is thw WEB AUTHENTICATION from Cisco Documents.
The user associates to the web authentication SSID.
The user opens their browser.
The WLC redirects to the guest portal (such as ISE or NGS) as soon as a URL is entered.
The user authenticates on the portal.
The guest portal redirects back to the WLC with the credentials entered.
The WLC authenticates the guest user via RADIUS.
The WLC redirects back to the original URL.

How to use ISE Guest Portal for AD users

Hi there,
As subject explains all, I want to use ISE Guest Portal for my domain users. I have tried many different ways to authenticate users and finally I came to the conclusion that ISE CWA works pretty well and is very stable. WLC Webauth sucks alot, does not redirect to the login page always.
Can you please share what other ways are stable ways to authenticate AD users? I know about WPA 802.1x authentication but that requires a CA in the network which is not available at the moment. So can you please Suggect?
Otherwise, I want to use ISE Guest Portal for my AD users as well. AD is already integrated to ISE, the issue happens when I attempt to athenticate using AD user account, the user gets authenticated but the Guest Portal redirects me to Device Provissioning page and there it shows an error saying "there is not policy to register the device, contact system admin"
Am I missing something??
I am running WLC 5760 with ISE 1.2
Thanks in advance..

Hi,
Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE Guest Port Direction not working

Hi Guys,
Got a problem here with ISE guest authentication.
My configuration in the WLC is as bellows:
And the configuration in my ISE is as bellows:
After my device connects to the SSID, I cannot be redirected to the guest portal, no redirection URL showed up in my browser, while the URL is pushed to the WLC client as bellows:
DNS A record has been added before and I can open the FQDN.
Can anyone help me about this? Thanks!
Best Regards,
Savi

Are you able to ping / nslookup to ISE.wuscnad.com from the test client?
Also, please provide a screen shot of the set of ACL's CWA-Guest from the WLC?
Here is a document you can go through to configure wireless CWA
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
Regards,
Jatin

Requesting a work DNS for apple devices

Just to the point : i cannot download any app / music from appstore / itunes using google dns ,
It keeps cannot download app.
If using my ISP dns it will not allow me to connect to internet on all apple device but on pc work.
Is there any dns for this problem?

Captive portal/wispr support for apple ios7
CSCuj18674
Description
Symptom:
When attempting to access the Guest Portal with an Apple iOS 7 device while the WLC "Captive Portal Bypass" feature is enabled, the web sheet on the device still appears, preventing the user from continuing the flow.
Conditions:
The Apple device is running Apple iOS 7.
Workaround:
In the ACL on the WLC used for captive portal redirection and exemption of special traffic for the Guest Portal, add exemptions for the IP resources that resolve from "www.appleiphonecell.com" and "captive.apple.com" FQDNs.
IMPORTANT NOTE: These IP addresses are associated with the FQDNs of "www.appleiphonecell.com" and "captive.apple.com" and are subject to change by the entities hosting those domains. If the IP addresses do change, the ACL would need to reflect that.

I am hacked on all my apple devices. How to solve the issue? Please help!

Hi everyone,
So whenever I open certain websites on Safari, suddenly I am redirected to either a women's health or a doctor's ad. (I am guessing this is called phishing)
1)I've asked my friends if they've had the same problem with those certain sites and they replied no. Does this mean it is about my network? (I am the only one using this network at my home as I live alone)
2)This happens on all my Apple devices including iPad and iPhone (when I tried to open the same website on my İphone while using mobile data, the problem did not happen- when I opened wifi on my phone it happened. same for iPad as well)
Admedic said there were no adware, I have never changed my DNS so it has always stayed the way it always was also. So I am guessing my network is the problem. (I am also guessing that this happened after I tried to watch a movie free online) BUT, this problem does not occur with Google Chrome on the same website. So is this about my network or my safari?
I am now so scared if this person who hacked me gets all my information. What am I supposed to do? Please help!

Hi! Thanks for your quick reply.
A few things happened since I've posted this.
1)I've deleted all the history and cookies from my macbook safari and when I opened the website with the issue, the problem did not happen this time.
2)Seeing this, I've deleted my history on iPhone's safari and opened the same website but the problem was there again.
3)The problem does not happen on iPad.
So, I do not have the problem at all on Google Chrome but on Safari (now just on iPhone)
Is this still about my router settings? If so would changing my phone DNS settings would suffice? Or do you think the problem might still remain on my computer as well?
This is so frustrating for a person who does not know anything about technology at all
Thank you!

Apple Devices ISE GUEST REDIRECT

Similar Messages

Maybe you are looking for