How to use ISE Guest Portal for AD users

Hi there,
As subject explains all, I want to use ISE Guest Portal for my domain users. I have tried many different ways to authenticate users and finally I came to the conclusion that ISE CWA works pretty well and is very stable. WLC Webauth sucks alot, does not redirect to the login page always.
Can you please share what other ways are stable ways to authenticate AD users? I know about WPA 802.1x authentication but that requires a CA in the network which is not available at the moment. So can you please Suggect?
Otherwise, I want to use ISE Guest Portal for my AD users as well. AD is already integrated to ISE, the issue happens when I attempt to athenticate using AD user account, the user gets authenticated but the Guest Portal redirects me to Device Provissioning page and there it shows an error saying "there is not policy to register the device, contact system admin"
Am I missing something??
I am running WLC 5760 with ISE 1.2
Thanks in advance..

Hi,
Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
Thanks,
Tarik Admani
*Please rate helpful posts*

Similar Messages

Guest Anchor with web auth using ISE guest portal

Hello All,
Before launching into my exact issues, could anyone confirm if they have completed a wireless Guest anchor setup using 2504 controllers on 7.4 as the anchor (5508 is the foreign) with webauth external redirection at ISE 1.1.3 using ISE Guest Services?
I am attempting this for an internal POC and have hit a couple of issues. Firstly I am looking for correct configuration confirmation prior to going in depth with a couple of the issues. I've been using the TrustSec 2.1 how to guides to build the parts I am not strong on so if anyone has actual completed this setup, I'd love to go through it with you.
massive thanks to anyone that can assist.
JS.

Thanks for the reply RikJonAtk.
so to start with, based on the trust sec documents, of the guest WLAN on the anchor I need to configure mac filtering at the layer 2 security menu as well as enable RADIUS NAC under the Advanced tab. But when I do this, I get an error message that states that mac filitering and RADIUS NAC cannot be enable at the same time.
Additionally, if I just enable the RADIUS NAC setting under the Advanced tab in the WLAN, I get another error message that states that the priority order for Web-Auth can only be set for radius, so I go to the AAA server tab and send local and LDAP to the not use column and hit apply. If I move to another menu then check the priority order again under the AAA servers tab, the local and LDAP have been moved back to the menu field to be used again. So I initially though it might be a bug, but I was hoping to find someone here that has done this already and can look at my issues and maybe walk me through their configs, which I'll mirror and see how it goes.
Thanks in Advanced,
JS

How to use single JSP page for multiple users.

Hi ,
I am doing messenger kind of program using JSP and tomcat server.
When i type message it is showing in the some div. If some other person request for the same page by giving my IP address and jsp page, he should able to see what i have typed on page so far.
how can i do that one . can any one guide me .
Thanks in advance.

SuneelGoodatJava wrote:
Hi ,
I am doing messenger kind of program using JSP and tomcat server.
When i type message it is showing in the some div. If some other person request for the same page by giving my IP address and jsp page, he should able to see what i have typed on page so far.
how can i do that one . can any one guide me .
Thanks in advance.HTTP is a request/response protocol. You can't do what you're suggesting without "pushing" what you type to all the other users. That's not the way HTTP works. Maybe an applet and servlet.
%

How to use a generic sender for all users in SCOT

Hi.
I´m trying to find a way to define a static sender for all the mails sent from our SAP system.
It automatically takes the email adress set un the user data (SU01 tcode) but our mail server does not allow that adresses.
We can get the access just for one single emeil adress.
The easy solution would be to change everyone´s email adress data to the same one, but I´m trying to find another solution, a way to define a "static" sender for the mails, not taking not from the user data.
Any advise and help will be higly appreciated.
Regards.

Well as a workaround you can create an email address/folder and provide this in SOCT and then from this mail folder , setup a rule to forward the mail to all receipients.

ISE Guest Portal and one more SSID using internal accounts

Hi Guys,
I have two SSIDs on WLC, the first is related with ISE Guest Portal and the second is related with employee but i realize that the
Guest user can access the employee SSID and employee accounts can access the Guest portal page.
I guess this is happen because i cannot split these databases under "Internal Users" on Authentication Policy.
How can i restrict the access even if i am using the internal databse?
thanks a lot

using the Authorization policy is the right way. Match the corp ID store to the corp WLAN SSID ID in the AuthZ policy, for example (where Employee is your corp ID store and yyyy is the name of your corp SSID):

Pb to reach ISE Guest portal due to DNS constraints

I have set up a Guest Portal with WLC 5508 7.4 and ISE 1.1.1 ;
everything is OK, except one thing :
the Guest VLAN, associated to the Guest SSID is, actually, a DMZ behind my customer firewall and the DHCP parameters provided to the wireless Guest equipement connected on this VLAN include the public ISP DNS servers addresses, not the customer internal DNS serveurs addresses;
this seems OK since the idea of this Guest SSID is to give a pure Internet access to the Guests, and no connection at all towards the customer internal servers;
the problem is that, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this internal DNS name by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
Apart from changing those DNS values in the DHCP server (the customer does not accept this solution), how could we solve this problem ?
I have tried to code manually , in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://192.168.1.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa,
but, it does not work, since the sessionIdValue variable is not replaced by its real value when sent to the wireless client
any comment welcomed

We had the same issue. Our solution was to advertise the internal IP address from our external facing DNS server and let it propagate publicly. Our ISE box is in a DMZ and the firewall rules do not allow outside traffic to it, however the clients will get the correct internal IP address and since they are already inside the firewall on the DMZ segment they are able to get to the ISE box with the publicly resolved internal IP address. The other option we entertained was a firewall DNS redirect. That would work by intercepting the DNS request for that specific URL and return the proper internal IP, all other DNS requests would pass through to the public DNS server.

Using ISE guest store via RADIUS

I have a question concerning the guest store on the ISE.
I would like to establish a guest portal on a WLC (currently running version 7.0.220.0). The guest network shouldn’t have any connection to the company network. So I can’t redirect to the ISE guest portal and have to use the local portal on the WLC and pass the login data to the ISE via RADIUS. Nevertheless I want to use the guest store on the ISE.
On the ISE I can only select the internal user store as identity source. But this seems not to include the guest user store.
Has anyone already implemented a similar solution or any idea how to access the guest store?
Thanks
Thomas

I just created a simple setup and tested the login.
It doesn't work with a user created as a guest account.
If I create the user in the normal internal identity store I works fine.
Might there be a difference between ISE Versions?
We are currently using Version 1.1.0.665 on a VM for testing purpose.
This is what the details show:
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24206 User disabled
22057 The advanced option that is configured for a failed authentication request is used
22061 The 'Reject' advanced option is configured in case of a failed authentication request
11003 Returned RADIUS Access-Reject
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24212 Found User in Internal Users IDStore
22037 Authentication Passed
Evaluating Authorization Policy
15004 Matched rule
15016 Selected Authorization Profile - Guest
11022 Added the dACL specified in the Authorization Profile
11002 Returned RADIUS Access-Accept

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

ISE Guest portal CWA - Webauth exit button on Login Successful page not working (Safari and Chrome)

Hello
Has anyone else experienced the issue where this exit button works when IE is used to login to the ISE Guest portal, but not when Chrome is used. Same for Safari (from IPAD).
Sent from Cisco Technical Support iPad App

Google Chrome is not a fully supported browser for use with the Administrative User Interface of the Identity Services Engine (ISE), Version 1.1.3 and earlier.

ISE - Guest Portal Voucer

hi all,
my customer has set Wireless LAN Guest Voucher for 28 days however after 6 days its not working.
Our customer gives Wireless LAN Guest User a 28 days voucher from ISE Guest Portal Solution. After 6 days of using the accounts will not work. Must be deleted and added new. These accounts are not expired, but the login will fail after 6 days.
any idea why this is or do I need to escalte this to Cisco?
regards,
Lance

You might have another limiter in there. have are your durations configured?
//////only if expiring////////////////////////
You are probably hitting the account duration set on the Sponsor Group that created the voucher.
this can be set under administration -> sponsorgroups -> click on the sponsor group in question -> authorization levels -> and set the Max duration for accounts.

How to use one email adress for multiple recipients

Hello,
I'd like to know how to use one email adress for multiple recipients.
this would be very useful or projects. for example;
if i send one mail to [email protected], all people in this project get an email.
I will add the people in this project myself.
I know it is possible, but I don't know how to do it ;-)
please help me!

Hope this help.
_http://technet.microsoft.com/en-us/library/cc164331(v=exchg.65) .aspx

How do I use the same profile for two users on the same computer

I use my laptop both at home and at work. And in each venue I use a different user log on. But I wish to have firefox use the same profile for each user log on. How can I get firefox to point to the same profile for each user?

Note that only one user (Firefox instance) can use a profile folder at the time, so if you would switch the Windows user to another account then you would first have to close Firefox.
* http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows
* http://kb.mozillazine.org/Shortcut_to_a_specific_profile
* http://kb.mozillazine.org/Using_multiple_profiles_-_Firefox
* http://kb.mozillazine.org/Bypassing_the_Profile_Manager

How to Use the same iview for both KM End User and the KM Administrator

Hi friends,
*This is my scenario :* How to Use the same iview for both KM End User and the KM Administrator but with different Context
Menu Options.
i followed these steps but im getting same context menu for both KM End User and the KM Administrator .
Assign the role Content Administrator to the user km_admin. This is needed so that km_admin can change
the presentation settings for the KM Folder u201EReports_kmFolder‟.
Now, login with user km_admin. Navigate to the Km Folder reports_kmFolder through Content Administration
-> Km Content. Click on Details link of the folder reports_kmFolder.
Go To Settings -> Presentation. Click on the tab u201ESettings for You‟-> Click on button u201ESelect Profile‟.
Select the radio button corresponding to u201Elayout Set‟, and choose u201EConsumerExplorer‟ from the dropdown.
Click u201EOK‟.
Select both the check boxes corresponding to Items Affected as shown above, and click u201ESave‟
Now, remove the u201ESuper Administrator‟ role from the user km_admin and login with this user.
How rto resolve this????
Regards,
Prasad.

Hello Prasad,
Most likely the user km_admin still has system principal roles assigned, even though you removed the Super Admin role, you should check that this user doesn't have any other admin roles, otherwise it will be considered a System Principal user and will therefore still have access to all content. For more information see http://help.sap.com/saphelp_nw70/helpdata/en/19/56f28fbd4e11d5993b00508b6b8b11/frameset.htm
Try creating a new user with just read access to the content and you should see that it will not be able to make any changes etc.
Regards,
Lorcan.

HT1660 how can I use one single library for all users on the same laptop?

how can I use one single library for all users on the same laptop?

You are most of the way there. Each user having access to hard drive is the key. If users are limited in file privileges this is harder.
Any files you add to your library and any files she adds to her library are available to the other. Just not automatically. Each user must add the files to their own library using the add file or add folder option from menu bar.
What I have done is set library location to a location outside of My Documents\My Music. On my network storage I have a folder names s:\itunes. Both accounts iTunes are set to use this location for the library.

How to use multiple VCI strings for lap 1300 and 1200 (option 60) in one pool?

Hi All,
Hope to you a very happy new year,
I have two differnt LAP 1300 and 1200 in my network and I need to add theme to the WLC,
I successed to add one of theme by the option 60 in the DHCP pool at the Core SW,
So my quetion is below:
How to use multiple VCI strings for lap 1300 and 1200 (option 60) in one pool?
Thanks in Advanced,
Ahmed,

To add to Scott's post. Option 60 would be useful if you needed to put certain types of AP on specific controllers. Otherwise, no real need to use it for the most part.
Though, I do recall an issue a few years ago that some windows machines had issues getting DHCP if option 43 is being returned.
Now, on an IOS switch, you can only configure one option 60 per DHCP scope
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

How to use ISE Guest Portal for AD users

Similar Messages

Maybe you are looking for