Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.
Hi to all,
I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID. The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
Error: Resource not found.
Resource: /guestportal/
Does anyone have any ideas why the portal is doing this?
Thanks
Paul
Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again.
Similar Messages
-
Cisco ISE Guest Portal - DNS Issue - External Zone
Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.Robert,
Manual assignment has been made available in ISE 1.2 release.
M. -
ISE Guest Port Direction not working
Hi Guys,
Got a problem here with ISE guest authentication.
My configuration in the WLC is as bellows:
And the configuration in my ISE is as bellows:
After my device connects to the SSID, I cannot be redirected to the guest portal, no redirection URL showed up in my browser, while the URL is pushed to the WLC client as bellows:
DNS A record has been added before and I can open the FQDN.
Can anyone help me about this? Thanks!
Best Regards,
SaviAre you able to ping / nslookup to ISE.wuscnad.com from the test client?
Also, please provide a screen shot of the set of ACL's CWA-Guest from the WLC?
Here is a document you can go through to configure wireless CWA
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
Regards,
Jatin -
Response.Redirect not working after printing CR
Using Visual Studio 2010 sp1 with Crystal for VS 2010. Web app running as a web application in x86 mode using .NET 4.0 framework.
I recently created a CR with a sub-report and it previews and prints just fine. However, after I PRINT the report, my code behind in the ASPX file is not recognized and thus fails.
For example, I created a 'Back' button to redirect the CR aspx back to the calling aspx file and it works just fine if I only view the report. If I click on the printer icon located on the report viewer toolbar, the button stops working. In fact, none of the code behind syntax is recognized and the aspx file just does a page_load.
I know this code works because it does work if I DON"T print the report:
protected void btnBack_Click(object sender, EventArgs e)
Response.Redirect("~/NewCase.aspx");
I also have a 'Submit' button that changes the data parameters for the report and it works great but after I print the report, it will not work either. (I've tried to upgrade to sp2 but I get an error with the installation process... so still trying to figure that out.)
protected void btnSubmit_Click(object sender, EventArgs e)
CrystalReportViewer1.RefreshReport();
To summarize, All the code I listed works fine if I do not try to print the report and just view it. After I click the printer icon, the code stops being recognized and the aspx page just refreshes.
I've searched for help on the web for a couple of days to no avail; so I am thinking it must be some issue with the report viewer.
Any help would be greatly appreciated.
PaulNot a problem. Something like what is described in the following should help (from the easiest to the more complicated):
[1411677 - Blank first page in Visual Studio .NET application using the Crystal Reports DHTML viewer|http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes_boj/sdn_oss_boj_bi/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/scn_bosap/notes%7B6163636573733d36393736354636443646363436353344333933393338323636393736354637333631373036453646373436353733354636453735364436323635373233443330333033303331333433313331333633373337%7D.do]
[1625033 - Page navigation button does not work as required using Crystal Report .NET web application|http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes_boj/sdn_oss_boj_bi/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/scn_bosap/notes%7B6163636573733d36393736354636443646363436353344333933393338323636393736354637333631373036453646373436353733354636453735364436323635373233443330333033303331333633323335333033333333%7D.do]
[1670041 - How to persist Crystal Reports using Cache in a custom .NET web application?|http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes_boj/sdn_oss_boj_bi/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/scn_bosap/notes%7B6163636573733d36393736354636443646363436353344333933393338323636393736354637333631373036453646373436353733354636453735364436323635373233443330333033303331333633373330333033343331%7D.do]
- Ludek -
Dears,
I want to configurate guest portal(Central Web authentication) for wireless client on Cisco ISE. I confuse that:
Must i configure redirect ACL in switch? If yes which access-group or which interface i applied this redirect ACL?
I read that must be create redirect ACL in WLC.I also do my configuration form these guide. In this guide write that:
reate the Authorization Profile
On the ISE, the authorization profile must be created. Then, the authentication and authorization policies are configured. The WLC should already be configured as a network device.
In the authorization profile, enter the name of the ACL created earlier on the WLC.
Click Policy, and then click Policy Elements.
Click Results.
Expand Authorization, and then click Authorization profile.
Click the Add button in order to create a new authorization profile for central webauth.
In the Name field, enter a name for the profile. This example uses WLC_CWA.
Choose ACCESS_ACCEPT from the Access Type drop-down list.
Check the Web Redirection check box, and choose Centralized Web Auth from the drop-down list.
In the ACL field, enter the name of the ACL on the switch that defines the traffic to be redirected. This examples usescwa_redirect.
this confuse me. -
ISE Guest Activity Report not working (1.2.0.899)
Recently I upgraded an ISE to 1.2.0.899. I found the Guest Activity Report is not working. Before the upgrade it was working properly (with the limitation of 5000 records by report). Nothing in the ASA was modified, but nothing is reported in the ISE; also I use the tcpdump integrated in the ISE to validate the syslog messages are arriving from the ASA to the ISE. I already enable the Passed Authentication logging category.
Do I need to modify something else,to have the report?Hi
Please make sure these steps has configured correctly:
Step 1 Create an alarm, as described in Creating, Editing, and Deleting Alarm Schedules.
Step 2 Specify a rule for Passed Authentication, Failed Authentications, or Authentication Inactivity for all users of type guest, as described in Creating and Assigning an Alarm Rule.
Step 3 Calculate guest user activity by Monitoring Live Authentications. -
Cisco Ise Central Web authentication not working
Hello Guys,
CWA is not working. It says that authentication suceeded but posture status is pending. No error in my Monitor--authentication. Checking it in my Windows 7, it does not shows the CWA portal.
What might be the possible problem of this.?
thanksKindly review the below links:
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml -
NAC guest server hangs and guest portal is not working
Hi all ,
Our guest nac server NAC3315 is oftenly getting hung state . And our guest wireless network is not working . We are able to ping the NAC server but web page is not opening for the clients if they connected to guest network.
Any clue on this ....
Thanks!,
Regards,
Vijay.All actions within the Cisco NAC Guest Server are logged into the database. This enables you to see any action that occurred as part of the normal operating process of the application.
To access the system log from the administration interface select Server > System Log from the left hand menu
Please check the Error Logs for troubleshooting of NGS -
Cisco ISE Guest portal - smart card login
Does anyone know if Cisco ISE support smart card login to the guest portal page?
No it doesn't, you can test the same , while editing the wireless SSID profile, opting authentication method as smart card other than PEAP/EAP.
-
IPhone 4 ear speaker not working after 2 restores and cleaning the headphone socket.
Hi,
I know this problem is not uncommon, but here goes...
I have an iPhone 4 which was running iOS 5.1.1 a few days ago when the ear speaker stopped working. I cant hear the other person when I make or recieve a call, but nothing else is wrong with the phone. It is 18 months old.
I've searched the discussions and seen some of the suggestions. I tried cleaning out the headphone socket, with no luck. I then tried a full restore and update to iOS 6. This appeared to have worked. I tried 2 calls and I could hear the other person. I then left the phone alone for a couple of hours and when I tried it again, it had stopped working again.
I have since done another full restore but the speaker is still not working at all. The fact that it worked after the first restore suggests it's something simple or software related but I have no idea what else to try other than getting it repaired in a shop. The problem is I am in Japan where my network (Softbank) and an independent repair shop have both quoted me the equivalent of $176 / £110 to fix it.
Does anyone know anything else I can try before I give in and end up shelling out this ridiculous cost for something that is probably a 20 minute fix?
Any help would be appreciated.
ThanksI have the exact same problem with my ear speaker after my IOS 6 upgrade. My speakers work, bluetooth works, the earphones work, but the ear speaker doesn’t work. I noticed this IMMEDIATELY after the upgrade was completed. I also have the following problems:
-Very slow call connect time. 30 - 45 seconds just to connect is typical. Signal strength is 5 bars (ATT)
-Problems attaching to known networks
-Very slow internet browsing with many timeouts on both the ATT 3G service and known Wi-Fi networks.
- My camera was missing after the IOS 6 upgrade. I restored that from Restrictions inside of the Settings App
- Music was so screwed up it was easier to just restore it
I went to the Apple store hoping to get some support. Between my wife, my son, and myself we have purchased 4 iPhones and an iPad over the last few years with plans to purchase another iPad in a month or so. So it’s not like I' not familiar with Apple Technology and their typical level of support.
The individual who waited on me was rude and condescending. He insisted that all of the problems were hardware related or ATT’s fault, or my fault. He further asserted that IOS 6 had NOTHING to do with any of the problems. I pointed out that it would be quite a coincidence for my hardware to break, for ATT to have network problems, and for me to suddenly forget how to use an iPhone at the same exact moment that IOS 6 had been installed. He maintained his position and offered to sell me another phone.
I don’t expect the folks in the store to reprogram the OS. Mistakes happen. I’m going to guess that Apple’s OS programmers are already working on a fix for many of the IOS 6 complaints that are easy to find on Google. Assigning blame to the customer and denying any responsibility is not a model for success or customer service. I’m sure Apple wouldn’t accept that kind of excuse from their component manufacturers and don’t think it is how they should deal with their customers. Further, Apple wants to own the device. They want to control the apps, the OS, battery, the delivery channel. I’m good with that so long as when there is a problem, they own that as well.
And BTW… I’m not including the maps in my list of issues with IOS 6 because I kind of like the new maps and am willing to give Apple the benefit of the doubt. I believe that their map service will get a lot better in a hurry. -
Phone not working after line move and number change
Hi. I just removed my line on my on plan and changed my number. Now my phone will not work such as making calls.
Did you reactivate the phone?
Try restarting the phone by holding down the top/power button and the Home button at the same time until the phone restarts.
Try dialing *228 from the phone and follow the instructions to activate the phone.
Try logging on to your MyVerizon account from a computer and select "Activate Device". -
I brought my Iphone on the At and T site 3 months ago and it's not working how can I have it repaired?
I think that you should just contact the place you bought it from and have them take a look at it, and if you have the warrenty on your iPod you can get a new replacement too.
-
IPod is not working after being formatted and restored.
This isn't the first time this has happened to my iPod classic. In a span of about 5 months, I've visited the Genius Bar, and one has been replaced under warranty. Now, the newly replaced one has suffered the same things that the old iPod has experienced. One day, as I was syncing new music, iTunes suddenly froze and had to abort the sync, making me eject the iPod without the sync completing. So, iTunes deleted all of my data (music, photos, videos, etc.). Now, each time I plugged in my iPod following that, iTunes had always frozen, and did not let me access the Devices tab and restore my iPod. Then, having a PC, I formatted it to its default settings, seeing that my computer recognized the iPod and iTunes did not. A pop-up box came up saying if I wanted to fix the problem on the iPod, and I prompted to do so. It completed, and it said my iPod was fully functional. Soon after, it was recognized by iTunes again, and said that it had corrupted files and needed to be restored, seeing that the iPod was under the Devices tab once again. I did so, the restoration was completed, and iTunes said that once after the iPod restarted, it would appear once again under the Devices tab. But, however, it did not appear, after leaving it plugged in for about 5 minutes. iTunes froze again, and now the process begins all over again.
I have fully updated my iTunes, and I am using an HP Pavillion Notebook, under Windows 7.
I need help. I don't want to go back to make a reservation at the Genius Bar since the iPod is no longer under warranty, and perhaps I can fix it on my own. Will they be able to fix it under no charge? What should I do?Also, if I eject it from the folder where all Devices are on my computer, the iPod restarts, and the restoration process on iTunes starts all over again.
-
Hey guys.
I just got my brand new Lenovo e540 and I really like it. I only got one problem and would like to know if there is a fix for it.
I swapped the fn- and strg-key in BIOS setttings and everything went fine at first. But then I realized that some strg-combinations aren't working.
The following combinations are not working: strg+b, strg+p, strg+s (as far as I remember) And it is really annoying if you can't save your notepad-document with strg+s.
Now I came across these information:
Fn+B= break
Fn+P= pause
Fn+S= sysrq
Fn+C= ScrLK
Fn+I= insert
Is it possible, that this is the source of my problem? Because technically im still pressing the fn-key when doing my strg+s combinations because I swapped the keys in BIOS. The odd thing is, that strg+c is working absolutely fine.
I already tried disabling all services and programs starting when booting up the pc but the problem still occured.I want to update the bios so much, especially because of the cleaned-up noise when using 3D...
But i can't because of the darn shortcuts (FN+S is especially troublesome for me).
Come on guys, please add an option to disable those shortcuts or atleast make them swap when we swap ctrl+fn. -
We have Cisco Wireless with ISE (Identity Service Engine) to provide guest access with CWA (central web authentication). The idea is to provide guest access with open authentication, so anyone can connect. Then when the guest trying to browse the internet it will be redirected to guest protal for authentication. So only corporate guest with valid password can pass the portal authentication. This is been working fine for windows machine, android, and apple devices with earlier OS version (working on OSX 10.8.5). For clients that's been upgraded to OSX 10.10.1 or IOS 8 they can no longer load the CWA redirection page.
Please let us know if there's any setting under the OSX to solve the issue, or plan from apple to fix the issue on the next OSX/IOS release ?
thanks - ciscosxRobert,
Manual assignment has been made available in ISE 1.2 release.
M.
Maybe you are looking for
-
I have a ListView displaying a collection of icons. The user can then select different icons (checkboxes) to do things like Copy or Delete. Problem is, when I try to delete the actual file from the disk, I get an error telling me the file is "in use"
-
Sever issue with Xorg and Nvidia Drivers
I run a 2.6.20 kernel with Xorg and Nvidia drivers all from arch rep on a Asus NV6200. Everything works fine, except one thing. When I exit X, the monitor shuts down imediatly. It wont start up at all, not even by manual startup. I cant understand wh
-
Suggestion and Comments for a w530 unit
Hello Everyone, I've been using macbookpro for almost 4 years, and since I heavily use AutoCad, Sketchup and Lightroom on a daily basis it has been a bothersome to rebooth from one OS to another. I have been looking at the W530 for quite sometime and
-
Hello, I wonder could anybody help me with this problem... Essentially, when I turn on my PB G4 i first get a globe picture, then the flashing question mark (its searching for the startup disk presumably...) This screen then freezes after a couple of
-
Aftee downloading the new ios8 software there is still a "1" notification on my settings. Can anyone tell me how to get rid of it? there is nothing that calls for attention once I get into the settings app. So I'm not sure what to do.