Cisco vWLC and Central Web Authetication ISE Issue

Hello!
I have an issue with Wireless Central Web Authentication. Wired CWA woking fine.
My APs woking in FlexConnect mode with local switching. When I connect to the WLAN with CWA, web page with guest portal in not opening, but I see, that redirect is working...
When I try to ping ISE, and have a strange result:
y@5733Z:~$ ping 10.10.2.47
PING 10.10.2.47 (10.10.2.47) 56(84) bytes of data.
64 bytes from 10.10.2.47: icmp_seq=5 ttl=63 time=1.45 ms
64 bytes from 10.10.2.47: icmp_seq=8 ttl=63 time=2.22 ms
64 bytes from 10.10.2.47: icmp_seq=10 ttl=63 time=1.43 ms
^C
--- 10.10.2.47 ping statistics ---
21 packets transmitted, 3 received, 85% packet loss, time 20106ms
rtt min/avg/max/mdev = 1.430/1.703/2.223/0.367 ms
When I change the security method on the WLAN to open or any other, ping to ISE working fine. Please help!

Central Web Auth (CWA) works different on controllers/APs running in FlexConnect mode. Please check this guide and confirm that you have similar setup.
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html
If so, please post screen shots with your configs (Redirect ACLs, policies in ISE and the WLC SSD settings).
Also, the version of code that you are running in ISE and your controller.
Thank you for rating helpful posts!

Similar Messages

Wlc flexconnect wlan local authentication and central web authentication maximum rtt

Hi
From the below link below it mentioned that "Round-trip latency must not exceed 300 milliseconds (ms) between the AP and the controller. If the 300 milliseconds round-trip latency cannot be achieved, configure the AP to perform local authentication."
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/emob73dg/emob73/ch7_HREA.html#wp1094148.
Is this limitation refer to web authentication also?
Thanks
Anyone???

Central Web Auth (CWA) works different on controllers/APs running in FlexConnect mode. Please check this guide and confirm that you have similar setup.
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html
If so, please post screen shots with your configs (Redirect ACLs, policies in ISE and the WLC SSD settings).
Also, the version of code that you are running in ISE and your controller.
Thank you for rating helpful posts!

Quick Question about Cisco 3560 and the Web Device Manager

Alright, I have a quick question that I am curious about but I haven't found any information
about it.
When I log into my Cisco 3560 using the web portal to get to the Device Manager. Below the
diagram of the switch, then under the Dashboard there is section called Switch
Health, Port Utilization.
Under the Switch Health there is Bandwidth Used, Packet Error. Those two options just sit
at zero and do not move. The Port tilization graph is also sitting at zero.
Is there a way to make them functional?

Anyone notice performance increase or decrease of their HD when using the nVidia IDE SW drivers? particularly with a 74GB Raptor? I've also heard of burner issues when installing the IDE SW but have not used my burner yet.

ISE and central web authentication

Hello all,
I have followed the steps in this document in detail:
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml
however, my central authentication does not work. I get to the guest portal, i get authenticated through the guest portal,
but then the "second" MAB authenticatino doesn't happen.
In the last screencapture of the document, you get a green "Dynamic Authorization" line (third line from below). On my system
this is a red line with the error message "11213 No response received from Network Access Device".
(i have a successfull guest authentication in my ise logs, but it seems ise is unable to bounce or initiate the second MAB....)
Any ideas ?
regards,
Geert

By the way, i feel the document example is a bit too general. For example, if you implement the document, ISE will do web authentication and redirection even when you are using a 802.1X client and are authenticated (and you have no other rules in your Autorization sequence table)
I managed to prevent this by adding an additional condition to the first rule "MAC not known" that has the CentralWebAuth policy. Only do webautentication if MAC not known AND Wired_MAB is being used.

WLC 7.5 Sleeping clients with ISE and Central WEB Auth(CWA)

Hi there,
Is it possibe to use sleeping clients when using ISE and CWA?
I was thinking of enabling layer3 auth with web auth on mac auth failure, but will that work with CWA?
Or is the only solution to use LWA?

Controller-> General-> User Idle Timeout (seconds) = 50 000 sec.
And your users will be connected all this time even if they going in sleepmode
be carefull with CPU loading

OSX 10.10.1 with Cisco ISE guest portal using (CWA) central web authentication issue

We have Cisco Wireless with ISE (Identity Service Engine) to provide guest access with CWA (central web authentication). The idea is to provide guest access with open authentication, so anyone can connect. Then when the guest trying to browse the internet it will be redirected to guest protal for authentication. So only corporate guest with valid password can pass the portal authentication. This is been working fine for windows machine, android, and apple devices with earlier OS version (working on OSX 10.8.5). For clients that's been upgraded to OSX 10.10.1 or IOS 8 they can no longer load the CWA redirection page.
Please let us know if there's any setting under the OSX to solve the issue, or plan from apple to fix the issue on the next OSX/IOS release ?
thanks - ciscosx

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

Central Web Auth with Anchor Controller and ISE

Hi All
I have a 5508 WLC on the corporate LAN and another 5508 sat in a DMZ as an anchor controller.
I also have an ISE sat on the corporate LAN.
Authenticate is working fine to the ISE and the client tries to re-direct to the ISE Portal but doesn't get there.
DNS is working fine and the client can resolve the URL of the ISE to the correct IP address.
I have a redirect ACL configured on the foreign controller which permits DNS, DHCP and traffic to and from the ISE.
My questions are:
1. Do I need to re-direct ACL to be present on both the foreign and anchor controllers?
2. Since the Radius requests originate from the foreign controller do I need to configure the ISE server address on the WLAN on the anchor?
3. Does the re-direct ACL need to be enabled on the advanced page of the WLAN on the foreign to over-ride the interface ACL - I don't believe it does.
4. Is ICMP still blocked by the WLC until the web authentication is complete?
Thanks.
Regards
Roger

Hi Roger,
Thanks for your brief explanation here are the answers for your queries.
1. Do I need to re-direct ACL to be present on both the foreign and anchor controllers?
The only catch is that since this web authentication method is Layer 2, you have to be aware that it will be the foreign WLC that does all of the RADIUS work. Only the foreign WLC contacts the ISE, and the redirection ACL must be present also on the foreign WLC.
2. Since the Radius requests originate from the foreign controller do I need to configure the ISE server address on the WLAN on the anchor?
Yes, you have to configure the ISE server address on the anchor WLC.
3. Does the re-direct ACL need to be enabled on the advanced page of the WLAN on the foreign to over-ride the interface ACL
Yes, you should override AAA under advanced tab of WLAN as ACL will be present on the foreign WLC.
4. Yes, ICMP will work only after the sucessful web auth is complete.
Please do go through the link below to understand the Anchor-Foreigh Scenario.
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html#anc11
Regards
Salma

CWA using Cisco ISE issue

Good morning everyone,
I have some trouble to use my Cisco ISE to do Central Web Authentication. I followed this following configuration example : http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html
But for the moment, clients can't seee the web portal. My WLC and my Cisco ISE are well configured as presented in the document, when clients connect to the AP, they are listed into the Cisco ISE with the good authorization profile but, the URL redirection doesn't work as well as I want, clients have to enter manually the IP address in the web browser to log-in trough the Cisco ISE.
If anyone already had this problem, maybe could tell me more about that.
Thanks in advance!

Good news!
I have resolved my problem 15 minutes ago. For people who have the same problem, I have just changed my static route in my WLC. The issue was that I broadcast the same VLAN used for the management interface and in adding the network allowing admin to reach service-port, all traffic of my broadcasted VLAN was sent to the service-port. A simple netmask modification resolved the problem.
I have still a problem with CoA which doesn't work properly and I have to disconnect/reconnect to the SSID to have a complete access but I'm going to continue my research for that.
Thanks all for your help !!!!

5760 Central Web Auth with ISE

Hi,
I am having problems with getting central web auth to work on the 5760, I cant seem to find any documentation for the 5760-Central Web Auth.
The setup is with a Cisco 5760 and Cisco ISE, for guest users to be re-directed to ISE guest portal to authenticate. Has anyone configured this or have any advice, that would be great.
Thanks

Hi Roger,
I have gotten CWA running on the 5760 with ISE, below is the config for the guest SSID:
wlan Guest 1 TEST-guest
aaa-override
ip dhcp required
mac-filtering cwa_macfilter
mobility anchor 10.1.1.100
nac
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
security dot1x authentication-list ISE_Auth_Group
session-timeout 14400
no shutdown
! ***You will need the following commands as well:
ip http server
ip http authentication local
ip http secure-server
aaa authentication login ISE_Auth_Group group ISE
aaa authorization network cwa_macfilter group ISE
Hope it helps =)

Not Working-central web-authentication with a switch and Identity Service Engine

on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
The interface configuration looks like this:
interface FastEthernet0/24
switchport access vlan 6
switchport mode access
switchport voice vlan 20
ip access-group webauth in
authentication event fail action next-method
authentication event server dead action authorize
authentication event server alive action reinitialize
authentication order mab
authentication priority mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
spanning-tree portfast
end
The ACL's
Extended IP access list webauth
    10 permit ip any any
Extended IP access list redirect
    10 deny ip any host 172.22.2.38
    20 permit tcp any any eq www
    30 permit tcp any any eq 443
The ISE side configuration I follow it step by step...
When I conect the XP client, e see the following Autenthication session...
swlx0x0x#show authentication sessions interface fastEthernet 0/24
           Interface: FastEthernet0/24
          MAC Address: 0015.c549.5c99
           IP Address: 172.22.3.184
            User-Name: 00-15-C5-49-5C-99
               Status: Authz Success
               Domain: DATA
       Oper host mode: single-host
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
     URL Redirect ACL: redirect
         URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: AC16011F000000490AC1A9E2
      Acct Session ID: 0x00000077
               Handle: 0xB7000049
Runnable methods list:
       Method   State
       mab      Authc Success
But there is no redirection, and I get the the following message on switch console:
756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
I have to mention I'm using an http proxy on port 8080...
Any Ideas on what is going wrong?
Regards
Nuno

OK, so I upgraded the IOS to version
SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
I tweak with ACL's to the following:
Extended IP access list redirect
    10 permit ip any any (13 matches)
and created a DACL that is downloaded along with the authentication
Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
    10 permit ip any any
I can see the epm session
swlx0x0x#show epm session ip 172.22.3.74
     Admission feature: DOT1X
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
And authentication
swlx0x0x#show authentication sessions interface fastEthernet 0/24
     Interface: FastEthernet0/24
     MAC Address: 0015.c549.5c99
     IP Address: 172.22.3.74
     User-Name: 00-15-C5-49-5C-99
     Status: Authz Success
     Domain: DATA
     Oper host mode: multi-auth
     Oper control dir: both
     Authorized By: Authentication Server
     Vlan Group: N/A
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
     Session timeout: N/A
     Idle timeout: N/A
     Common Session ID: AC16011F000000160042BD98
     Acct Session ID: 0x0000001B
     Handle: 0x90000016
     Runnable methods list:
     Method   State
     mab      Authc Success
on the logging, I get the following messages...
017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
What I'm I missing?

VMware tools and hardware version for Cisco vWLC

I am currently running a Cisco vWLC (v8.0.100.0) on VMware vSphere 5.5U2 supporting about 20 APs. I just recently upgraded to vSphere 5.5U2 and I was working my way through updating the VMware tools and VM Versions on all my VMs when I glanced at this info for the vWLC. The vWLC shows a VM version of 1 with the VMware tools not running and not installed. I am curious if it is necessary or even possible to update the VMware tools and VM version for the vWLC. The vWLC is working perfectly fine and I have no issue with leaving well enough alone, but this just kind of peeked my curiosity as I really couldn't find any concrete answers in any online documentation. Does anyone have any insight on this matter?

If it's working, then leave it alone. Some of the Cisco virtual, well maybe most, don't support the VMWARE tools. Updating the version to the latest will make you have to use vCenter as the sphere client will not allow you to edit the VM anymore.
-Scott

Cisco 887 and TC 500GB dns issues

Hi,
I have a strange problem here so hopefully someone can help.
I recently replaced a Netgear adsl modem with a new Cisco 887 ADSL2 modem router. Now the Cisco does the PPPoE and the TC is in bridge mode. TC does the DHCP and clients connect to it via wireless. The Cisco takes care of all rounting and internet traffic.
My problem is that when I connect to the TC via the wireless with a PowerBook 17", IMac 21", IPhone 4, Ipad 1 and 2, web browsing times out on most sites.
But if I connect a Win XP, Win 7 or Blackberry to the TC wireless, no problem at all. All sites are quick and resolve instantly.
I checked all settings of all devices that the TC hands out and they are all the same. Same gateway, same DNS servers, same subnets and so on.
Even If I bypass the TC and connect via ethernet to the Cisco, the PowerBook and the IMac have the same issues. I connect Win XP and Win 7 to the Cisco and no problems.
Is there something I'm missing in the Cisco config that affects all Mac devices? I've had the Cisco checked by a CCIE and he sees no issues.
Is there a problem on the Macs connecting to the Cisco?
Any help would be greatly appreciated.
Regards,
AP

It is interesting as I just hit the problem last night for a simple setup.. not cisco. But standard ISP and wireless adsl modem router. It has worked fine up to last week according to my friend. She went to use it one day and no go.. but the router is getting IP address and gateway. From the PC it can open the router gui no problem. But no way will it pass packets.. it can ping the ISP gateway and sometimes the dns servers but is not consistent.
I used another modem and the issue was exactly the same. I tried wireless instead of ethernet.. no change. So now we are down to PC or ISP.. !!
ISP says everything good on their end.. although I take that with so much salt.. it needs preserving. They say that until you can prove the issue is them.
Anyway I had to get it going so bridged the modem and used pppoe client on the computer.. away everything goes. It is still having issues with ping to some sites.. so I still think this might be ISP. It can also be MTU but I tried lowering that in the router and got nowhere. She is finishing an MBA.. so I promised to reformat the computer after the end of term, and I can have another go.
Everything is supposed to work except when it doesn't. Good to teach humility every now and then. Just wish it didn't need to be so hard.

Routing issue between Cisco Nexus and Cisco 4510 R+E Chassis

We have configured Cisco Nexus 7K9 as core and Cisco 4510 R+E as access switches for Server connectivity.
We are experiencing problem in terms of ARP learning and Ping issues between Cisco Nexus and end hosts.

Hi,
So you have N7k acting as L3 with servers connected to 4510?.
Do you see the MAC associated with failing ARP in 4510?. Is it happening with all or few servers?. Just to verify if it is connectivity issue between N7k and 4510, you can configure an SVI on 4510 and assign address from same raneg (server/core range) and perform a ping.
This will help narrow down if issue is between server to 4510 or 4510 to N7k.
Thanks,
Nagendra

SharePoint 2013 and IE 11 issue - While creating a Web Part Page and Editing Web Part Properties

I tried to edit a Web Part in SharePoint 2013 using IE 11 but I did not see the Edit Eeb Part dropdown menu at the top-right corner of the web part. Then I tried to create a Web Part page and I get the following error.
Cannot create a Web Part Page with the current browser. Browsers that support the creation of Web Part Pages include Microsoft Internet Explorer 7.0 or later, Mozilla Firefox 3.0 or later, and Apple Safari 3.0 or later
Strange !!! My web browser is IE 11.
I tried the above two tasks in Google Chrome and worked fine.
Solution:
I added the site url to local intranet zone in IE 11 and I am now able to add Web Part Page and Edit Web Part in IE 11.
imd.net

Hi - One more solution is to add SharePoint site to compatibility group:
http://blog.fpweb.net/sharepoint-internet-explorer-compatibility-issues-with-video/#.VAaZSPmSyy4
-prs

MacBook Air intermittently has issues connecting to websites when wireless shows connected to the internet. The pages show that I am offline, but I can ping Google DNS. Windows PC, iPhone and Android phone have no issue displaying the same web pages.

MacBook Air intermittently has issues connecting to websites when wireless shows connected to the internet. The pages show that I am offline, but I can ping Google DNS. Windows PC, iPhone and Android phone have no issue displaying the same web pages.How do I solve this issue?

Go step by step and test.
1. Power off the router. Unplug it from the wall. Wait a while.
    Plug it back to the wall. Power the router on. Wait until all the lights are lit properly. It will take a while.
    Restart the computer.
    Start up in Safe Mode.
    http://support.apple.com/kb/PH14204
2. Empty Caches
    Safari > Preference > Advanced
    Checkmark the box for "Show Develop menu in menu bar".
    Develop menu will appear in the Safari menu bar.
    Click Develop and select "Empty Caches" from the dropdown.
3. Deselect Proxies if selected.
    System Preference > Network > Advanced > Proxies Tab
    Under "Select Protocol", uncheck any box if selected.
    Click "OK" then "Apply”.

Cisco vWLC and Central Web Authetication ISE Issue

Similar Messages

Maybe you are looking for