HTTPS Guest Portal Redirection

Dears,
We have Guest Portal on ISE server, when our guests connect to Guest SSID they automatically redirected to WEB portal
it works only with http websites
if user writes in his browser for example facebook.com or some websites with https redirection doesnt happens
thank you

It's new:) the first version of 8.0.100.0 wasn't great if you ask me. v8.0.110.0 is MR1 and fixes some issues but it's new. I would wait for MR2/3 before going into production unless you really need to go to v8.0. You can always downgrade. You need to make sure your AP's support this code and if you have WCS/NCS/PI and or MSE. Here is the compatibility matrix:
http://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html
-Scott

Similar Messages

  • 5760 v3.6 guest portal redirect to ISE

    I'm testing a new set of 5760 controllers for a future production rollout, running software version 3.6.  Our current production setup consists of older WISM-1 and 4402 controllers running CUWN 7.0.  Our guest network has an anchor in the DMZ, redirecting to ISE.
    In the recent thread (https://supportforums.cisco.com/discussion/12319151/3850-ise-guestportal-no-redirect-v-334), one of the posters said that guest redirection in 3.6 works similarly to redirection in CUWN, while in 3.3 it is very different.  I found the documentation for 3.3 (http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html), which I have to say I don't like very much.  However, I find the configuration and command reference guides for 3.6 are less than helpful on this point. 
    So the question I have is whether guest networking with an external redirect to ISE looks like the following in 3.6?  Or does it work like CUWN, where the SSID is configured with layer 3 security?  If it uses layer 3 security like CUWN, does anybody have a quick configuration sample for how it can work end to end in 3.6?
    ------ From the document http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html ---------
    The flow includes these steps:
    The user associates to the web authentication Service Set Identifier (SSID), which is in fact open+macfiltering and no Layer 3 security.
    The user opens the browser.
    The WLC redirects to the guest portal.
    The user authenticates on the portal.
    The ISE sends a RADIUS Change of Authorization (CoA - UDP Port 1700) in order to indicate to the controller that the user is valid, and eventually pushes RADIUS attributes such as the Access Control List (ACL).
    The user is prompted to retry the original URL.

    I have a project with a 5760 running 3.6 working to a 5508 anchor controller in a DMZ.
    I have web authentication working to an ISE OK.
    Regards
    Roger

  • ISE Wired guest portal redirect even after authentication

    Hi
    I have configured both Wired and Wireless guest authentication via guest portal. Wireless is working fine, however the when trying with Wired, the redireciton page is keep getting even after user authenticated.
    I'm not seen the redirection authorization policy in my logs however I can see only the user authentication logs (successful). Attached is my configuration and logging output.
    Here is what I see on the interface
    ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
                Interface:  GigabitEthernet4/0/19
              MAC Address:  a0b3.ccca.2ab1
               IP Address:  10.1.3.16
                User-Name:  A0-B3-CC-CA-2A-B1
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://xxxx-TW-ISE-2.xxx.xxx.qa:8443/guestportal/gateway?sessionId=AC14011F000001571E52779F&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC14011F000001571E52779F
          Acct Session ID:  0x00000309
                   Handle:  0xE6000158
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success
    Here is the ACL
    Extended IP access list ACL-WEBAUTH-REDIRECT
        10 deny udp any any eq domain (1344 matches)
        20 deny ip any host 172.20.5.12 (8122 matches)
        30 deny ip any host 172.20.5.14
        40 permit tcp any any eq www (3124 matches)
        50 permit tcp any any eq 443 (202927 matches)
        60 permit tcp any any eq 8080 (114 matches)
        70 permit ip any any (8056 matches)

    Hi Mohannad,
    Thanks for your response.
    Actually the as per the configuration it should work, I'm still trying to find out what is what has gone wrong with this configuration. Infact I have tested with 3560 switch with the same config and it worked. only difference here is we used 2960S switch.
    We need to find out why the next Auth policy is not hitting once user is authenticated.
    Here is the port configuration and the authen status of the port.
    ABQT-3FLR-ACC-01#sh running-config interface gig4/0/19
    Building configuration...
    Current configuration : 427 bytes
    interface GigabitEthernet4/0/19
    switchport access vlan 103
    switchport mode access
    switchport voice vlan 135
    authentication event fail action next-method
    authentication host-mode multi-auth
    authentication order dot1x mab
    authentication priority dot1x mab webauth
    authentication port-control auto
    authentication violation restrict
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 10
    spanning-tree portfast
    end
    ABQT-3FLR-ACC-01#
    Mar 31 12:32:14.127: %AAA-3-BADSERVERTYPEERROR: Cannot process accounting server type tacacs+ (UNKNOWN)
    ABQT-3FLR-ACC-01#
    ABQT-3FLR-ACC-01#sh atuh
    ABQT-3FLR-ACC-01#sh atu
    ABQT-3FLR-ACC-01#sh authe
    ABQT-3FLR-ACC-01#sh authentication se
    ABQT-3FLR-ACC-01#sh authentication sessions in
    ABQT-3FLR-ACC-01#sh authentication sessions interface gi
    ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
                Interface:  GigabitEthernet4/0/19
              MAC Address:  0015.c5b4.fd4a
               IP Address:  10.1.3.23
                User-Name:  00-15-C5-B4-FD-4A
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://ABQ-TW-ISE-2.abq.gov.qa:8443/guestportal/gateway?sessionId=AC14011F0000018A32B4D906&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC14011F0000018A32B4D906
          Acct Session ID:  0x00000394
                   Handle:  0x3E00018B
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success

  • Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

    Hi to all,
    I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
    I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID.  The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
    Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
    Error: Resource not found.
    Resource: /guestportal/
    Does anyone have any ideas why the portal is doing this?
    Thanks
    Paul

    Hello,
    As you are not able to  get the guest portal, then you need to assure the following things:-
    1) Ensure that the  two  Cisco av-pairs that are configured on the  authorization profile should  exactly match the example below. (Note: Do  not replace the "IP" with the  actual Cisco ISE IP address.)
    –url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
    –url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also  defined on the access switch)
    2) Ensure that the URL redirection portion of the ACL have been  applied  to the session by entering the show epm session ip   command on the switch. (Where the session IP is the IP address  that is  passed to the client machine by the DHCP server.)
    Admission feature : DOT1X
    AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
    URL Redirect ACL : ACL-WEBAUTH-REDIRECT
    URL Redirect :
    https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
    0000A45A2444BFC2&action=cpp
    3) Ensure that the preposture assessment DACL that is enforced from  the  Cisco ISE authorization profile contains the following command  lines:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8906 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
    4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on  the switch as follows:
    ip access-list extended ACL-WEBAUTH-REDIRECT
    deny ip any host 80.0.80.2
    permit ip any any
    5) Ensure that the http and https servers are running on the switch:
    ip http server
    ip http secure-server
    6) Ensure that, if the client machine employs any kind of personal  firewall, it is disabled.
    7) Ensure that the client machine browser is not configured to use any  proxies.
    8) Verify connectivity between the client machine and the Cisco ISE IP  address.
    9) If Cisco ISE is deployed in a distributed environment, make sure  that  the client machines are aware of the Policy Service ISE node FQDN.
    10) Ensure that the Cisco ISE FQDN is resolved and reachable from the  client machine.
    11) Or you need to do re-image again.

  • ISE HTTP GUEST PORTAL

    Hello,
    We have some disconfort with Guest web authentication. When WLC redirects a guest user, he views certificate error.
    Can I use http instead https for guest portal?
    Thanks,
    Oleg

    Hi,
    Is your guest portal on the ISE ? In the ISE , there is only HTTPS port allowed to configure under Guest portal and no option of http port is there , So I dont think so. You also might be using port 8443 in the external web-auth redirection URL under security tab.
    Now even if you put a valid certificate on the ISE which hosts external guest portal , still you would receive certificate warning as long as you use local web server of the controller which is its virtual ip address.This is because even if the external web server where page is hosted for example has a valid certificate , even then internal virtual ip address is presented to the client.
    So
    > either you trust them in your browser so that you dont receive certificate warnings
    >or else have a valid certificate on the controller and external web server. 
    > or use http for web authentication in the controller and also http to external hosted page, then also you can get rid of these certificates.
    Regards
    Dhiresh

  • ISE Guest Portal redirection not working

    I have built a lab at home. I have a Win2008 Server for AD/DNS, ISE 1.2 (VM trial), a 3560-cg switch, 2500 WLC and 2602i AP. I have configured everything as per the documentations online. My issue is that when I connect to the open SSID, it gets connected and has the dns server populated as well, but the redirection never takes place. I can search for google or cnn.com but it just stays at looking up host or something. However, if i take the redirect URL from the WLC and then do it on the browser, it does go to the guest portal. Let me know what issues I can see and if there is any other information I can provide.

    Issue resolved.
    Since my lab environment didnt have access to the internet and hence dns servers 8.8.8.8 would not resolve any public ips. But when an address is resolvable by a dns then it redirects nicely. For test I created a dns entry on the dns server itself and tested it.
    Sent from Cisco Technical Support Android App

  • Guest portal redirection with mulple PSNs

    Hi All
    In a distributed deployment where there is more than one PSN's how do we have a common url for guest redirection when doing a CWA (assuming no load balancer is used for the PSNs)? usually the redirection url would be 'https://<ise01.fqdn/guetsportal" or 'https://<ise02.fqdn/guetsportal" and we can only specify one in the wlc guest ssid?
    Thanks

    Fully Qualified Domain Name in URL Redirection
    When Cisco ISE builds an authorization profile redirect (for central web authentication, device registration web authentication, native supplicant provisioning, mobile device management, and client provisioning and posture services), the resulting cisco-av-pair includes a string similar to the following:
    url-redirect=https://ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
    When processing this request, Cisco ISE substitutes actual values for some keywords in this string. For example, SessionIdValue is replaced with the actual session ID of the request. For eth0 interface, Cisco ISE replaces the IP in the URL with the FQDN of the Cisco ISE node. For non-eth0 interfaces, Cisco ISE uses the IP address in the URL. You can assign a host alias(name) for interfaces eth1 through eth3, which Cisco ISE can then substitute in place of IP address during URL redirection. To do this, you can use the ip host command in the configuration mode from the Cisco ISE CLI:
    ISE /admin(config)# ip host IP_address host-alias FQDN-string
    where IP_address is the IP address of the network interface (eth1 or eth2 or eth3)
    host-alias is the name that you assign to the network interface
    FQDN-string is the fully qualified domain name of the network interface
    Using this command, you can assign a host-alias or an FQDN-string or both to a network interface.
    Here is an example:
    ISE/admin(config)# ip host a.b.c.d sales sales.amer.xyz.com
    After you assign a host alias to the non-eth0 interface, you must restart the application services on Cisco ISE using the application start ise command.
    Use the no form of this command to remove the association of the host alias with the network interface:
    ISE/admin(config)# no ip-host IP_address host-alias FQDN-string
    Use the show running-config command to view the host alias definitions.
    If you provide the FQDN-string, Cisco ISE replaces the IP address in the URL with the FQDN. If you provide only the host alias, Cisco ISE combines the host alias with the configured IP domain name to form a complete FQDN, and replaces the IP address in the URL with the FQDN. If you do not map a network interface to a host alias, then Cisco ISE uses the IP address of the network interface in the URL.
    When you make use of non-eth0 interfaces for client provisioning or native supplicant or guest flows, you have to make sure that the IP address or host alias for non-eth0 interfaces should be configured appropriately in the Policy Service node certificate's SAN fields.

  • ISE-Guest Portal Redirection

    Dears
    i have configured everything right for the Gusset login and everything is going the way i want except one thing that the switch doesn’t force the quest to web directed to the ISE login paged however the ouput of the below command looks perfect and when i copy the url manually it works .. so how can i make it automatically ?
    ISE-SWITCH#sh authen se int f0/12 
                Interface:  FastEthernet0/12
              MAC Address:  c80a.a96a.47b1
               IP Address:  Unknown
                User-Name:  C8-0A-A9-6A-47-B1
                   Status:  Authz Success
                   Domain:  DATA
          Security Policy:  Should Secure
          Security Status:  Unsecure
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
               Vlan Group:  N/A
                  ACS ACL:  xACSACLx-IP-CENTRAL_WEB_AUTH-50683952
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://EG1SHQ06.HEIWAY.NET:8443/guestportal/gateway?sessionId=0A8B080600000005001ECF63&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  0A8B080600000005001ECF63
          Acct Session ID:  0x00000007
                   Handle:  0xD9000005
    Runnable methods list:
           Method   State
           mab      Authc Success
           dot1x    Not run
    ISE-SWITCH#sh ip access-l
    Extended IP access list ACL-WEBAUTH-REDIRECT
        10 deny ip any host 10.139.8.216
        11 permit tcp any any eq www
        12 permit tcp any any eq 443
    Extended IP access list Auth-Default-ACL-OPEN
        10 permit ip any any (314 matches)
    Extended IP access list xACSACLx-IP-CENTRAL_WEB_AUTH-50683952 (per-user)
        10 permit udp any any eq domain
        20 permit icmp any any
        30 permit tcp any any eq www
        40 permit tcp any any eq 443
        50 permit tcp any host 10.139.8.216 eq 8443

    i did this changes and even upgraded the switch IOS to 12.2(58)SE2 but no luck ,
    any other idea?
    ISE-SWITCH#sh ip access-l               
    Extended IP access list ACL-DEFAULT
        10 permit udp any eq bootpc any eq bootps
        20 permit udp any any eq domain
        30 permit icmp any any
        40 permit udp any any eq tftp
        50 permit tcp any host 10.139.8.216 eq www
        60 permit tcp any host 10.139.8.216 eq 443
        70 permit tcp any host 10.139.8.216 eq 8443
        80 permit tcp any host 10.139.8.216 eq 8905
        90 permit udp any host 10.139.8.216 eq 8905
        100 permit udp any host 10.139.8.216 eq 8906
        110 permit tcp any host 10.139.8.216 eq 8080
        120 permit udp any host 10.139.8.216 eq 9996
        130 deny ip any any log
    Extended IP access list ACL-POSTURE-REDIRECT
        10 deny udp any any eq domain
        20 deny udp any host 10.139.8.216 eq 8905
        30 deny udp any host 10.139.8.216 eq 8906
        40 deny tcp any host 10.139.8.216 eq 8443
        50 deny tcp any host 10.139.8.216 eq 8905
        60 deny tcp any host 10.1.252.21 eq www
        70 permit ip any any
    Extended IP access list ACL-WEBAUTH-REDIRECT
        10 deny ip any host 10.139.8.216
        20 permit tcp any any eq www
        30 permit tcp any any eq 443
    Extended IP access list Auth-Default-ACL-OPEN
        10 permit udp any eq bootpc any eq bootps
        20 permit udp any any eq domain
        30 permit icmp any any
        40 permit udp any any eq tftp
        50 permit tcp any host 10.139.8.216 eq www
        60 permit tcp any host 10.139.8.216 eq 443
        70 permit tcp any host 10.139.8.216 eq 8443
        80 permit tcp any host 10.139.8.216 eq 8905
        90 permit udp any host 10.139.8.216 eq 8905
        100 permit udp any host 10.139.8.216 eq 8906
        110 permit tcp any host 10.139.8.216 eq 8080
        120 permit udp any host 10.139.8.216 eq 9996
        130 deny ip any any
    Extended IP access list xACSACLx-IP-CENTRAL_WEB_AUTH-50683952 (per-user)
        10 permit udp any any eq domain
        20 permit icmp any any
        30 permit tcp any any eq www
        40 permit tcp any any eq 443
        50 permit tcp any host 10.139.8.216 eq 8443

  • How to use ISE Guest Portal for AD users

    Hi there,
    As  subject explains all, I want to use ISE Guest Portal for my domain  users. I have tried many different ways to authenticate users and  finally I came to the conclusion that ISE CWA works pretty well and is  very stable. WLC Webauth sucks alot, does not redirect to the login page  always.
    Can  you please share what other ways are stable ways to authenticate AD  users? I know about WPA 802.1x authentication but that requires a CA in  the network which is not available at the moment. So can you please  Suggect?
    Otherwise,  I want to use ISE Guest Portal for my AD users as well. AD is already  integrated to ISE, the issue happens when I attempt to athenticate using  AD user account, the user gets authenticated but the Guest Portal  redirects me to Device Provissioning page and there it shows an error  saying "there is not policy to register the device, contact system  admin"
    Am I missing something??
    I am running WLC 5760 with ISE 1.2
    Thanks in advance..

    Hi,
    Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
    In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • ISE Guest Access- Redirect to URL after successful logon

    Currently, when guest users attempt to browse they get redirected to the guest portal.  After login, they get a message that they can now access the original URL.  Is there a way to automatically redirect to the URL they were trying to access, or remember the URL after they login?

    ISE guest flow :
    The user associates to the web authentication Service Set Identifier (SSID).
    The user opens the browser.
    The WLC redirects to the guest portal (such as ISE or NGS) as soon as a URL is entered.
    The user authenticates on the portal.
    The guest portal redirects back to the WLC with the credentials entered.
    The WLC authenticates the guest user via RADIUS.
    The WLC redirects back to the original URL

  • ISE Guest Portal only redirect HTTPS traffic.

    I have a wireless deployment consisting of the following:
    5760 WLC & ISE 1.2
    Am I missing something here
    I have 4 similar deployments, and never had these issues:
    On Android / Apple devices, the guest portal does not pop up automatically &
    On a Windows Laptop only https traffic directs to the guest portal.
    Thanx

    i think you need to recheck the configuration also check the link for step by step config
    http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-security/landing_DesignZone_TrustSec.html

  • Cisco ISE 1.2 Guest Portal customization with vWLC redirect

    Hello Support Community,
    we have a problem regarding customized web authentication on ISE 1.2 with Package ISE12CustomPortalPackage-v4.zip. We have a Virtual Wireless Controller where we do a redirect to ISE. When we use default guest portal on https://x.x.x.x:8443/guestportal/Login.action authentication and authorization works fine. When we do redirect to Cisco templates on https://x.x.x.x:8443/guestportal/portals/example/Login.html customized login page is displayed and after correct authentication guest successful page is displayed but we can't go to any webserver although ISE shows authentication and authorization as successful. When we try to reach a webserver after successful authentication we get redirected to customized login site. Virtual Wireless Controller shows client aus "Webauth Required" after successful authentication. Central Web Authentication isn't possible because we have a different AAA Server for 802.1X and only use wired guest access on a particular VLAN from WLC. Are there any known issues regarding customization template or is there something wrong regarding our redirect?
    I hope somebody can help us.
    Best Regards
    Benjamin

    Hello Neno,
    1. I attached screenshots below.
    2. There is nothing related to this client.
    3. I attached Debug below.
    We are currently using MAB on our switches as a fallback to our 802.1X on our wired access. Order and Priority currently is 802.1X/MAB/Auth-Fail-VLAN. CWA is based on a failed MAC-Authentication which leads to an Authorization Profile to permit access with Webauth.
    If you configure Wired guest access on WLC there isn't a possibility to configure MAC-Authentication.
    CWA on our switches isn't possible because we are currently using failed MAC-Authentication to direct clients to our Auth-Fail-VLAN which has restricted access secured by SVI-ACL which allows us HTTP Access to printers (manual Cert Deployment) and automated Cert enrollment to our computers.
    Best Regards
    Benjamin

  • ISE 1.1.3 Guest portal (Web redirection) what worked for me !!!

    Hello,
    this document lead to multiple failure !!!!
    http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml
    This guy really helps !!!
    https://www.youtube.com/watch?v=TW2ZJVIZ8bs
    See attached screen captures.
    ISE documentation, even published by TAC is not reliable.
    Bring back the Cisco we liked so much 15 years ago !!!!!

    Hello Jan
    You can customize the look-and-feel of the end-user portals by uploading your company's logos, background images, or color schemes. These changes apply to the My Devices, Sponsor, and Guest portals, but you can assign different images and colors to the mobile Guest portal.
    These settings allow you to change the appearance of the portals without having to upload customized HTML files to the Cisco ISE server. However, if you want to create themes unique to specific Guest portals, you must upload your custom HTML files instead.
    Step 1 Choose Administration > Web Portal Management > Settings > General > Portal Theme.
    Step 2 Upload the graphics and change the color settings in the Style Settings section to customize the standard portals.
    Step 3 Upload the graphics and change the color settings in the Mobile Device Style Settings to customize the Guest mobile portal.
    Step 4 Click Save.

  • Cisco ISE Guest Portal - DNS Issue - External Zone

    Hello,
    I have a customer that has the following sceanrio :
    In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect  URL  from ISE (URL to access the ISE Guest Portal), this URL is based on  the  ISE DNS name, not on its IP address; so, the PC can't resolve  this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided  by the  DHCP server, and, so, it can't access the Guest Portal at all ;
    I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
    cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
    since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
    My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
    Thank-you in advance for your replies.
    Robert C.

    Robert,
    Manual assignment has been made available in ISE 1.2 release.
    M.

  • Guest Portal web page load is slow and timesout on occasions

    Hi All,
    I'm hitting a rather unusual issue with our Guest WLAN users.  Firstly let me describe the topology:-
    2 x 5508 WLC controllers one Foreign and one Anchor.  Mobility tunnel between the two WLC's as the Guest WLAN is on the WLC sitting in the DMZ.
    30+ 2702i AP's running in FlexConnect mode for Dot1X WLAN and Central Switching for Guest WLAN.
    Cisco ISE 1.3 acting as Radius server and providing Authentication and Authorisation policies.
    Dot1x Authentication and Authorisation works fine with Dynamic VLAN assignment based on AD memberships.
    The issue is with the Guest WLAN is that from a security perspective we weren't allowed to use the Central Web Authentication using L2 MAC filtering with the L3 Security of None as described in Cisco Document: 115732.
    So the Guest WLAN has been set up with no L2 security and the L3 Security of Web Policy with Web Authentication to External Server i.e. Cisco ISE and RADIUS override on the Advanced tab of the Guest WLAN.
    So a client connects to the Guest WLAN SSID > receives the DHCP IP address hosted by the Anchor WLC and then one opens a  browser types in the URL and the Security message is presented > Continue to this website (not recommended) selected and the process of receiving the Web Redirect Sign On Web page begins and hangs around forever.
    Depending on the Client i.e. Apple IPAD the sign on page loads correctly although can be slow to start with but a successful login is completed, but with windows clients and MAC Air books there is an issue with the browser either timing out the page and a retry is necessary or we can't move beyond the following page -  https://x.x.x.x:8443/portal /PortalSetup.action?portal=194a5780-5e4e-11e4-b905-005056bf2f0a?switch_url=https://1.1.1.1/login.html&client mac=00:23:4e:86:98:3c&wlan=GUEST&redirect=www.cisco.com/
    Any suggestions would be really appreciated with this as it's creating a lot of frustration.
    Thanks in advance.
    Regards,
    Mark

    Hi Mark,
    Yes Guest Cert will need to be external. Because Guest Users if they have a non-corporate laptop for example will not have your Internal Company Certs installed in their browser (that you loaded onto ISE), so they cannot trust your internal Cert.
    If your open Firefox or IE under Options/Security View Certificates you will see a list, if its a Guest you will see well known public Certs like Geotrust, Verisign etc.
    For my setup I brought a GeoTrust cert and loaded this into ISE, this way Guests will always Trust the Geostrust ISE cert like https://guest.com for example and the login will appear and be trusted.

Maybe you are looking for