Guest portal in distributed setup

Hi All,
How does the guest portal or the sponsor portals work in a distrubuted environment where two or more PSNs are running indivudually. Thats is,
1. does ISE redirects the user to the same guest portal url <PSN1 FQDN>/guestportal or PSN2 FQDN>/guestportal based on which PSN receives the request from a NAD?
2. how do we setup a generic url for the guest so the users will not see the <PSN1 or 2 FQDN> and could see a url like, example abc.com.us/guestportal regardless which POSN serves the request?
Thanks
G

Hi
FYI.
In Cisco ISE distributed deployment, administration and monitoring activities are centralized, and processing is distributed across the Policy Service nodes. Depending on your performance needs, you can scale your deployment. Each Cisco ISE node in a deployment can assume any of the following personas: Administration, Policy Service, and Monitoring. The Inline Posture node cannot assume any other persona, due to its specialized nature. The Inline Posture node must be a dedicated node.
For regarding generic url configuration, please have a look at the following link:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_dis_deploy.html#18995

Similar Messages

  • ISE 1.1 - Error Custom Guest Portal

    Ciao,
    we are facing a strange problem on ISE Custom Guest Portal.
    After pressing the login button it returns an error:
    Error:
    Resource not found.
    Resource:/guestportal/
    It seems like that te function "/guestportal/LoginCheck.action" is not able to return the succesfull login page.
    It's quite strange because user are authenticating without problem.
    Any clue?
    Ciao e grazie!
    Luciano

    Ciao,
    we faced the problem on clients connected in wireless, where WLC redirect to the custom guest portal.
    The setup works fine for almost 2 months, than it stop working; then we re-imaged the device (1st time).
    Digging in the log with SE of TAC (621986639) we found these errors:
    2012-06-06 13:55:32,152 ERROR 2012-06-06 13:55:32,152  [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
    2012-06-06 13:57:43,839 ERROR 2012-06-06 13:57:43,839  [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:8080/guestportal/gateway?sessionId=SessionIdValue&action=cpp
    2012-06-06 13:59:39,923 ERROR 2012-06-06 13:59:39,923  [http-443-5][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
    And during the test these errors were generated:
    2012-06-07 16:05:58,448 ERROR 2012-06-07 16:05:58,448  [http-8080-2][] org.apache.struts2.dispatcher.Dispatcher- Could not find action or result
    There is no Action mapped for action name Login. - [unknown location]
             at com.opensymphony.xwork2.DefaultActionProxy.prepare(DefaultActionProxy.java:186)
             at org.apache.struts2.impl.StrutsActionProxyFactory.createActionProxy(StrutsActionProxyFactory.java:41)
             at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:494)
             at org.apache.struts2.dispatcher.FilterDispatcher.doFilter(FilterDispatcher.java:422)
    So we performed another re-image (2nd time) with a different media (not sure the problem was the media, it should be some script fail)  today I'm performing some test ... I'll update this discussion asap.
    Ciao!
    Luciano

  • 5760 v3.6 guest portal redirect to ISE

    I'm testing a new set of 5760 controllers for a future production rollout, running software version 3.6.  Our current production setup consists of older WISM-1 and 4402 controllers running CUWN 7.0.  Our guest network has an anchor in the DMZ, redirecting to ISE.
    In the recent thread (https://supportforums.cisco.com/discussion/12319151/3850-ise-guestportal-no-redirect-v-334), one of the posters said that guest redirection in 3.6 works similarly to redirection in CUWN, while in 3.3 it is very different.  I found the documentation for 3.3 (http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html), which I have to say I don't like very much.  However, I find the configuration and command reference guides for 3.6 are less than helpful on this point. 
    So the question I have is whether guest networking with an external redirect to ISE looks like the following in 3.6?  Or does it work like CUWN, where the SSID is configured with layer 3 security?  If it uses layer 3 security like CUWN, does anybody have a quick configuration sample for how it can work end to end in 3.6?
    ------ From the document http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html ---------
    The flow includes these steps:
    The user associates to the web authentication Service Set Identifier (SSID), which is in fact open+macfiltering and no Layer 3 security.
    The user opens the browser.
    The WLC redirects to the guest portal.
    The user authenticates on the portal.
    The ISE sends a RADIUS Change of Authorization (CoA - UDP Port 1700) in order to indicate to the controller that the user is valid, and eventually pushes RADIUS attributes such as the Access Control List (ACL).
    The user is prompted to retry the original URL.

    I have a project with a 5760 running 3.6 working to a 5508 anchor controller in a DMZ.
    I have web authentication working to an ISE OK.
    Regards
    Roger

  • ISE 1.2 Guest Portal - Device registration portal

    Hello,
    I have a problem with the following setup:
    - Cisco ISE 1.2 (latest patch)
    - Cisco WiSM with 7.0.220.0 (first generation)
    I have build Guest access via ISE. Because the WiSM's highest version is 7.0.X I used LWA with a redirect to the ISE guest portal. When using the Guest SSID with a iPad the client is redirected to the ISE guest portal and the user can enter his credentials (deliverd by the Sponsor). After clicking "Sign On" the client is forwarded to the "Device Registration Portal" of ISE and need to register his MAC address.
    We have try a lot of differend settings but we cannot switch off the forward to the "Device Registration Portal". We only want to use the Guest User portal.
    Please can someone help me to find a solution for this problem?
    Thank you in advance.

    I know this might be reaching, but have you turned off the My Devices portal?
    If so, an idea of the different settings you have already tried might help.
    Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
    Charles Moreton

  • ISE 1.2 Guest Portal - This device has not been registered.

    I have setup and SSID on my WLC. I got the redirecting to my ISE guestportal working.
    However when I sign in I get a Device regitration Page
    "This device has not been registered"
    Unable to obtain the user information needed for network access.
    The device ID is grayed out and blank.
    Any assistance in this matter would be greatly appreciated

    Thanks Johnston,
    P.S for those who needs the path ISE 1.2 Administration -> Web Portal Management -> Settings -> Multi-Portal Configurations -> DefaultGuestPortal -> Operations.
    On another note
    When I login - I get my acceptable usage policy.
    Accept
    Then get a Device registration Portal where I can add the MAC address.
    Now I have two quistions.
    When I add my test mac address the url redirects to myservername:8443/guestportal/AfterDevReg.action - unable to connect <- that's the one issue.
    The other is - Can't I by pass the MAC? ie once the user is signed on to get access.
    Curretly I have the following settings enabled.
    Enable Mobile Portal
    Allow guest users to change password
    Guest users should be allowed to do device registration <- if I disable that after signon the page just flash back to the guest portal.

  • ISE Guest Portal - Error Resource not found

    Hello,
    When I create a guest user through the sponsor portal, then try to login with this guest user through the Guest Portal, after I press login button, the following error message occurs and do not know what to do to solve.
    Error: Resource not found.
    Resource: /guestportal/
    None of the messages on the forum about it helped me to solve the problem.
    I am using ISE 1.1.3.124 and this is a new re-image appliance.
    Can anyone help?                  

    Hello,
    As you are not able to  get the guest portal, then you need to assure the following things:-
    1) Ensure that the  two  Cisco av-pairs that are configured on the authorization profile should  exactly match the example below. (Note: Do not replace the "IP" with the  actual Cisco ISE IP address.)
    –url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
    –url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also  defined on the access switch)
    2) Ensure that the URL redirection portion of the ACL have been applied  to the session by entering the show epm session ip   command on the switch. (Where the session IP is the IP address that is  passed to the client machine by the DHCP server.)
    Admission feature : DOT1X
    AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
    URL Redirect ACL : ACL-WEBAUTH-REDIRECT
    URL Redirect :
    https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
    0000A45A2444BFC2&action=cpp
    3) Ensure that the preposture assessment DACL that is enforced from the  Cisco ISE authorization profile contains the following command lines:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8906 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
    4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on  the switch as follows:
    ip access-list extended ACL-WEBAUTH-REDIRECT
    deny ip any host 80.0.80.2
    permit ip any any
    5) Ensure that the http and https servers are running on the switch:
    ip http server
    ip http secure-server
    6) Ensure that, if the client machine employs any kind of personal  firewall, it is disabled.
    7) Ensure that the client machine browser is not configured to use any  proxies.
    8) Verify connectivity between the client machine and the Cisco ISE IP  address.
    9) If Cisco ISE is deployed in a distributed environment, make sure that  the client machines are aware of the Policy Service ISE node FQDN.
    10) Ensure that the Cisco ISE FQDN is resolved and reachable from the  client machine.
    11) Or you need to do re-image again.

  • Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

    Hi to all,
    I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
    I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID.  The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
    Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
    Error: Resource not found.
    Resource: /guestportal/
    Does anyone have any ideas why the portal is doing this?
    Thanks
    Paul

    Hello,
    As you are not able to  get the guest portal, then you need to assure the following things:-
    1) Ensure that the  two  Cisco av-pairs that are configured on the  authorization profile should  exactly match the example below. (Note: Do  not replace the "IP" with the  actual Cisco ISE IP address.)
    –url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
    –url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also  defined on the access switch)
    2) Ensure that the URL redirection portion of the ACL have been  applied  to the session by entering the show epm session ip   command on the switch. (Where the session IP is the IP address  that is  passed to the client machine by the DHCP server.)
    Admission feature : DOT1X
    AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
    URL Redirect ACL : ACL-WEBAUTH-REDIRECT
    URL Redirect :
    https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
    0000A45A2444BFC2&action=cpp
    3) Ensure that the preposture assessment DACL that is enforced from  the  Cisco ISE authorization profile contains the following command  lines:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8906 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
    4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on  the switch as follows:
    ip access-list extended ACL-WEBAUTH-REDIRECT
    deny ip any host 80.0.80.2
    permit ip any any
    5) Ensure that the http and https servers are running on the switch:
    ip http server
    ip http secure-server
    6) Ensure that, if the client machine employs any kind of personal  firewall, it is disabled.
    7) Ensure that the client machine browser is not configured to use any  proxies.
    8) Verify connectivity between the client machine and the Cisco ISE IP  address.
    9) If Cisco ISE is deployed in a distributed environment, make sure  that  the client machines are aware of the Policy Service ISE node FQDN.
    10) Ensure that the Cisco ISE FQDN is resolved and reachable from the  client machine.
    11) Or you need to do re-image again.

  • Guest Portal Access using ISE

    I’m having an issue setting up the Guest Port Access for our wireless network.
    I’m trying to setup an SSID anchored in the DMZ for internet access only. The authentication to this would be granted via the ISE Guest Access Portal.
    I’ve got the SSID created and tested working with no authentication.
    When I enable the Guest Portal (per these instructions http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bba10d.shtml), I can login and create a guest account. Have the guest go to the portal, login, hit ‘I accept’, but then instead of redirecting them to whatever page they tried to access, it sends them back to the guest login page (with still no access to the network resources).
    Am I missing a simple setting somewhere? Please let me know if this should be reposted in the security/ISE forum instead of here.
    Thanks,
    Pete

    Is this related?
    11036
    ERROR
    RADIUS
    The Message-Authenticator RADIUS attribute is invalid.
    A RADIUS packet having an invalid Message-Authenticator attribute has been received. Make sure that the client device is compatible with AD Agent, has been configured properly, and is functioning properly. Make sure that the same RADIUS shared secret has been properly configured, both in the client device and in AD Agent.
    Reference: http://www.cisco.com/en/US/docs/security/ibf/setup_guide/ibf10_log_msgs.html

  • Guest Portal with EUP Page Only

    I have a use case to provide a guest portal with EUP page only. ie. user only needs to accept the agreement and they should be given internet access, without need to enter username/password or self service. Is there an easy way to achieve this on ISE 1.2?
    Thanks in advance.

    Hi Mark,
    Yes Guest Cert will need to be external. Because Guest Users if they have a non-corporate laptop for example will not have your Internal Company Certs installed in their browser (that you loaded onto ISE), so they cannot trust your internal Cert.
    If your open Firefox or IE under Options/Security View Certificates you will see a list, if its a Guest you will see well known public Certs like Geotrust, Verisign etc.
    For my setup I brought a GeoTrust cert and loaded this into ISE, this way Guests will always Trust the Geostrust ISE cert like https://guest.com for example and the login will appear and be trusted.

  • Guest portal - free guest hotspot

    hi,
    where I can find a template for Guest portal / free guest hotspot?
    Thanks...
    This topic first appeared in the Spiceworks Community

    Hi
    FYI.
    In Cisco ISE distributed deployment, administration and monitoring activities are centralized, and processing is distributed across the Policy Service nodes. Depending on your performance needs, you can scale your deployment. Each Cisco ISE node in a deployment can assume any of the following personas: Administration, Policy Service, and Monitoring. The Inline Posture node cannot assume any other persona, due to its specialized nature. The Inline Posture node must be a dedicated node.
    For regarding generic url configuration, please have a look at the following link:
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_dis_deploy.html#18995

  • ISE 1.2 Guest Portal Profiling Certainty Factor not Increase

    Hi I have configure ISE 1.2 Guest Portal and check for profiling which device login but I found that endpoint profile not match after user succesful authenticate
    Profiling Configure and Endpoint Detail in attachment below

    Hi salodh
    as you can see in attach file all profiling are configure correctly and condition should be match according to User-Agent Contain Andriod (profile3.png) and Certainty Factor must increase (profile2.png) in this case but Total Certainty Factor still 0 in endpoint profile (profile1.png)

  • ISE 1.2 customizing guest portal

    I am having some issues trying to customize colours on the default guest portal in ISE 1.2.
    Is there really no way to change the entire page background colour, except going through creating a complete set of html files ?
    It seems if i upload a transparent background image for both the banner and the logo, and then change the all the gackground coulour settings, the colour only affects the area where the cisco splash logo is, and not the entire page.
    I attached my settings, and how the page looks with those, what i am after is the entire page black, and then white text.

    Hello Jan
    You can customize the look-and-feel of the end-user portals by uploading your company's logos, background images, or color schemes. These changes apply to the My Devices, Sponsor, and Guest portals, but you can assign different images and colors to the mobile Guest portal.
    These settings allow you to change the appearance of the portals without having to upload customized HTML files to the Cisco ISE server. However, if you want to create themes unique to specific Guest portals, you must upload your custom HTML files instead.
    Step 1 Choose Administration > Web Portal Management > Settings > General > Portal Theme.
    Step 2 Upload the graphics and change the color settings in the Style Settings section to customize the standard portals.
    Step 3 Upload the graphics and change the color settings in the Mobile Device Style Settings to customize the Guest mobile portal.
    Step 4 Click Save.

  • How to use ISE Guest Portal for AD users

    Hi there,
    As  subject explains all, I want to use ISE Guest Portal for my domain  users. I have tried many different ways to authenticate users and  finally I came to the conclusion that ISE CWA works pretty well and is  very stable. WLC Webauth sucks alot, does not redirect to the login page  always.
    Can  you please share what other ways are stable ways to authenticate AD  users? I know about WPA 802.1x authentication but that requires a CA in  the network which is not available at the moment. So can you please  Suggect?
    Otherwise,  I want to use ISE Guest Portal for my AD users as well. AD is already  integrated to ISE, the issue happens when I attempt to athenticate using  AD user account, the user gets authenticated but the Guest Portal  redirects me to Device Provissioning page and there it shows an error  saying "there is not policy to register the device, contact system  admin"
    Am I missing something??
    I am running WLC 5760 with ISE 1.2
    Thanks in advance..

    Hi,
    Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
    In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • ISE 1.2.1.198 - Guest Portal Configuration

    Is it possible to customize the default portal and add a paragraph any where on the login page with instructions?  I've tried adding the text in the Pre-Login Banner Text field, and it does wrap to the next line, but text goes of the screen before wrapping.  Would like to be able to add carriage return in the text, so text would scroll off the screen.

    ISE 1.3 (due out in November time frame) will have a huge amount of customization of the portal available for your use.
    If you really need to do it before then, and you have an ISE-certified Authorized Technology Partner you're working with, they have access to a Guest Portal Builder tool that can be used.
    Failing those, you're back to changing the native html code for the portal by hand. Not recommended.

  • Ise 1.2, cannot access guest portal

    I upgraded from 1.1.4 patch 3 to 1.2 but cannot access guest portal anymore nor with FQDN:8443 nor with IP:8443
    any idea?

    I had attached the steps to configure the guest portal and hope will address the problem.
    Configuring the Guest Portal
    Adding a New Guest Portal You must configure settings for the Guest portal before allowing guests to use it to access the network. Some settings apply globally to all Guest portals and other require you to set them for each portal individually.
    You can add a new Guest portal or edit an existing one.
    Step 1Choose Administration > Web Portal Management > Settings > Guest > Multi-Portal Configurations.
    Step 2Click Add.
    Step 3Update the fields on each of these tabs:
    •General—enter a portal name and description and choose a portal type.
    •Operations—enable the customizations for the specific portal
    •Customization—choose a language template for displaying the Guest portal with localized content
    •File Uploads—displays only if you have chosen a portal type requiring you to upload custom HTML files.
    •File Mapping— identify and choose the HTML files uploaded for the particular guest pages. Displays only if you have chosen a portal type requiring you to upload custom HTML files.
    •Authentication—indicate how users should be authenticated during guest login.
    Step 4Click Submit.
    Specifying Ports and Ethernet Interfaces for End-User Portals
    You can specify the port used for each web portal allowing you to use different ports for the end-user portals: Sponsor, Guest (and Client Provisioning), My Devices, and Blacklist portals. The Client Provisioning portal uses ports 8905 and 8909 for posture assessments and remediation, which you cannot change. Otherwise, it uses the same ports assigned to the Guest portal.
    You can also partition portal traffic to specific Gigabit Ethernet interfaces. For example, you might not want the Admin portal (which always uses GigabitEthernet 0) available on the same network as guest users or employee devices.
    Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
    Step 2Enter the port value in the HTTPS Port field for each portal. By default, the Sponsor, Guest, My Devices portals use 8443, and the Blacklist portal uses port 8444.
    Step 3Check the Gigabit Ethernet interfaces you want to enable for each portal.
    Step 4Click Save.
    If you have changed the port settings, all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
    Tips for Assigning Ports and Ethernet Interfaces
    •All port assignments must be between 8000-8999. This port range restriction is new in Cisco ISE 1.2. If you upgraded with port values outside this range, they are honored until you make any change to this page. If you make any change to this page, you must update the port setting to comply with this restriction.
    •You must assign the Blacklist portal to use a different port than the other end-user portals.
    •Any portals assigned to the same HTTPS port also use the same Ethernet interfaces. For example, if you assign both the Sponsor and My Devices portals to port 8443, and you disable GigabitEthernet 0 on the Sponsor portal, that interface is also automatically disabled for the My Devices portal.
    •You must configure the Ethernet interfaces using IP addresses on different subnets. Refer to these guidelines to help you decide how best to assign ports and Ethernet interfaces to the end-user portals:
    Specifying the Fully Qualified Domain Name for Sponsor and My Devices Portals
    You can set the Sponsor and My Devices portals to use an easy-to-remember fully-qualified domain names (FQDN), such as: mydevices.companyname.com or sponsor.companyname.com. Alternatively, Cisco ISE also supports wildcard certificates to address certificate name mismatch issues. You must configure DNS to resolve to at least one policy services node. If you have more than one policy services node that will provide portal services, you should configure high availability for the portal. For example, you could use a load balancer or DNS round-robin services.
    Before You Begin
    Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
    Step 2Scroll to the Portal FQDNs section, and check the appropriate setting:
    •Default Sponsor Portal FQDN
    •Default My Devices Portal FQDN
    Step 3Enter a fully qualified domain name.
    Step 4Click Save, and all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
    Step 5Configure the network DNS server so that it resolves the FQDN to the Sponsor or My Devices portal nodes. You must also update DNS to ensure the FQDN of the new URL resolves to a valid policy service node IP address. Additionally, to avoid certificate warning messages due to name mismatches, you should also include the FQDN of the customized URL in the subject alternative name (SAN) attribute of the local server certificate of the Cisco ISE policy service node.

Maybe you are looking for