Cisco ISE - Redirect CWA

Question

I'm new to ISE and have run into a snag that I'm not sure how to handle.  I have CWA configured and when I access the ISE SSID I am redirected to the guest login page.  When I login it asks me to accept the AUP, I accept, it tells me authentication is successful but when I try to browse to another site I can't get anywhere and it brings me right back to the guest login page.  Any ideas or suggestions?

Answer 1

That makes sense now, so you are not being dynamically mapped to the Guest as you would assume. You need to create another authorization policy that matches the group that you would like to allow your domain users (i.e. Domain Users).
You need to create this condition first by defining the group in Active directory (Administration > Identities > External Identity sources > Active Directory > Groups > Add > (there is a 100 group limit so you can search Domain* and that will pull anything that matches Domain and the wildcard).
If you have done the already they create another authoriztion policy and use this following:
Policy > Authorization > Insert New Rule [Above | Below] > Conditions (Create New Condition [Advance Option]) > Select Attribute (AD1 > ExternalGroup EQUALS [the group you chose before] > Set your result
Then test that should do the trick.
Thanks
tarik Admani