ISE 1.1 - Error Custom Guest Portal
Ciao,
we are facing a strange problem on ISE Custom Guest Portal.
After pressing the login button it returns an error:
Error:
Resource not found.
Resource:/guestportal/
It seems like that te function "/guestportal/LoginCheck.action" is not able to return the succesfull login page.
It's quite strange because user are authenticating without problem.
Any clue?
Ciao e grazie!
Luciano
Ciao,
we faced the problem on clients connected in wireless, where WLC redirect to the custom guest portal.
The setup works fine for almost 2 months, than it stop working; then we re-imaged the device (1st time).
Digging in the log with SE of TAC (621986639) we found these errors:
2012-06-06 13:55:32,152 ERROR 2012-06-06 13:55:32,152 [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
2012-06-06 13:57:43,839 ERROR 2012-06-06 13:57:43,839 [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:8080/guestportal/gateway?sessionId=SessionIdValue&action=cpp
2012-06-06 13:59:39,923 ERROR 2012-06-06 13:59:39,923 [http-443-5][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
And during the test these errors were generated:
2012-06-07 16:05:58,448 ERROR 2012-06-07 16:05:58,448 [http-8080-2][] org.apache.struts2.dispatcher.Dispatcher- Could not find action or result
There is no Action mapped for action name Login. - [unknown location]
at com.opensymphony.xwork2.DefaultActionProxy.prepare(DefaultActionProxy.java:186)
at org.apache.struts2.impl.StrutsActionProxyFactory.createActionProxy(StrutsActionProxyFactory.java:41)
at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:494)
at org.apache.struts2.dispatcher.FilterDispatcher.doFilter(FilterDispatcher.java:422)
So we performed another re-image (2nd time) with a different media (not sure the problem was the media, it should be some script fail) today I'm performing some test ... I'll update this discussion asap.
Ciao!
Luciano
Similar Messages
-
Activate custom guest portal in ISE
This question must sound stupid, but I'm struggling with it four two days now without success:
I've managed to upload custom HTML files for a custom guest portal via
Administration -> Web Portal Management ->Settings -> Guest -> Multi-Portal Management
and assigned files for the four required File Mappings (Login, AUP, Guest Success, Error)
However, where do I configure that this custom portal is actually used?
The only observable Difference to the DefaultGuestPortal I find is that under Authentication, it has the setting Identity Store Sequence = Guest_Portal_Sequence (greyed out) while my custom portal has this field empty (and also greyed out).
I merely found in the docs that the redirection URL should be schanged to mathc the portal name. However, my guess is that this URL is a RADIUS option and should thus be configurable on the ISE - somewhere, but I found nothing.
(While we're at it: Where can I configure the redirection to take place with hostname instead of ip? All examples in docs seem to use ip, but that is of course ridiculous in connection with https as it makes the use of certificates from well-known CAs impossible)Andreas:
You better move your discussion to Security -> AAA forums. They will be able to help you better.
Rating useful replies is more useful than saying "Thank you" -
ISE 1.2 customizing guest portal
I am having some issues trying to customize colours on the default guest portal in ISE 1.2.
Is there really no way to change the entire page background colour, except going through creating a complete set of html files ?
It seems if i upload a transparent background image for both the banner and the logo, and then change the all the gackground coulour settings, the colour only affects the area where the cisco splash logo is, and not the entire page.
I attached my settings, and how the page looks with those, what i am after is the entire page black, and then white text.Hello Jan
You can customize the look-and-feel of the end-user portals by uploading your company's logos, background images, or color schemes. These changes apply to the My Devices, Sponsor, and Guest portals, but you can assign different images and colors to the mobile Guest portal.
These settings allow you to change the appearance of the portals without having to upload customized HTML files to the Cisco ISE server. However, if you want to create themes unique to specific Guest portals, you must upload your custom HTML files instead.
Step 1 Choose Administration > Web Portal Management > Settings > General > Portal Theme.
Step 2 Upload the graphics and change the color settings in the Style Settings section to customize the standard portals.
Step 3 Upload the graphics and change the color settings in the Mobile Device Style Settings to customize the Guest mobile portal.
Step 4 Click Save. -
Ise 1.2, cannot access guest portal
I upgraded from 1.1.4 patch 3 to 1.2 but cannot access guest portal anymore nor with FQDN:8443 nor with IP:8443
any idea?I had attached the steps to configure the guest portal and hope will address the problem.
Configuring the Guest Portal
Adding a New Guest Portal You must configure settings for the Guest portal before allowing guests to use it to access the network. Some settings apply globally to all Guest portals and other require you to set them for each portal individually.
You can add a new Guest portal or edit an existing one.
Step 1Choose Administration > Web Portal Management > Settings > Guest > Multi-Portal Configurations.
Step 2Click Add.
Step 3Update the fields on each of these tabs:
•General—enter a portal name and description and choose a portal type.
•Operations—enable the customizations for the specific portal
•Customization—choose a language template for displaying the Guest portal with localized content
•File Uploads—displays only if you have chosen a portal type requiring you to upload custom HTML files.
•File Mapping— identify and choose the HTML files uploaded for the particular guest pages. Displays only if you have chosen a portal type requiring you to upload custom HTML files.
•Authentication—indicate how users should be authenticated during guest login.
Step 4Click Submit.
Specifying Ports and Ethernet Interfaces for End-User Portals
You can specify the port used for each web portal allowing you to use different ports for the end-user portals: Sponsor, Guest (and Client Provisioning), My Devices, and Blacklist portals. The Client Provisioning portal uses ports 8905 and 8909 for posture assessments and remediation, which you cannot change. Otherwise, it uses the same ports assigned to the Guest portal.
You can also partition portal traffic to specific Gigabit Ethernet interfaces. For example, you might not want the Admin portal (which always uses GigabitEthernet 0) available on the same network as guest users or employee devices.
Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
Step 2Enter the port value in the HTTPS Port field for each portal. By default, the Sponsor, Guest, My Devices portals use 8443, and the Blacklist portal uses port 8444.
Step 3Check the Gigabit Ethernet interfaces you want to enable for each portal.
Step 4Click Save.
If you have changed the port settings, all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
Tips for Assigning Ports and Ethernet Interfaces
•All port assignments must be between 8000-8999. This port range restriction is new in Cisco ISE 1.2. If you upgraded with port values outside this range, they are honored until you make any change to this page. If you make any change to this page, you must update the port setting to comply with this restriction.
•You must assign the Blacklist portal to use a different port than the other end-user portals.
•Any portals assigned to the same HTTPS port also use the same Ethernet interfaces. For example, if you assign both the Sponsor and My Devices portals to port 8443, and you disable GigabitEthernet 0 on the Sponsor portal, that interface is also automatically disabled for the My Devices portal.
•You must configure the Ethernet interfaces using IP addresses on different subnets. Refer to these guidelines to help you decide how best to assign ports and Ethernet interfaces to the end-user portals:
Specifying the Fully Qualified Domain Name for Sponsor and My Devices Portals
You can set the Sponsor and My Devices portals to use an easy-to-remember fully-qualified domain names (FQDN), such as: mydevices.companyname.com or sponsor.companyname.com. Alternatively, Cisco ISE also supports wildcard certificates to address certificate name mismatch issues. You must configure DNS to resolve to at least one policy services node. If you have more than one policy services node that will provide portal services, you should configure high availability for the portal. For example, you could use a load balancer or DNS round-robin services.
Before You Begin
Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
Step 2Scroll to the Portal FQDNs section, and check the appropriate setting:
•Default Sponsor Portal FQDN
•Default My Devices Portal FQDN
Step 3Enter a fully qualified domain name.
Step 4Click Save, and all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
Step 5Configure the network DNS server so that it resolves the FQDN to the Sponsor or My Devices portal nodes. You must also update DNS to ensure the FQDN of the new URL resolves to a valid policy service node IP address. Additionally, to avoid certificate warning messages due to name mismatches, you should also include the FQDN of the customized URL in the subject alternative name (SAN) attribute of the local server certificate of the Cisco ISE policy service node. -
Hello. Can I change default web guest portal: change background picture, logo, and add some-things.
Thansk.You can customize a portal theme, changing text, banners, background color, and images.
This section shows you how to create a custom portal theme, by setting and applying customized options.
You can follow the same steps to modify an existing customized portal theme.
Note: Supported image formats include jpg, jpeg, gif, and png.
To customize a portal theme, complete the following steps:
Step 1: From the Cisco ISE Administrator interface choose:
Administration > Guest Management > Settings.
Step 2: In the Settings panel on the left, Select
General > Portal Theme. (The Portal Theme page appears on the right.)
Step 3: Customize the portal theme in the following ways:
Change the Login Page Logo.
This setting allows you to change the logo on the portal Login page. You can choose the default Cisco
Logo or upload a custom image.
To upload a custom login page logo, complete the following steps:
Step 1: Select Upload New File from the drop-down menu.
Step 2: Click Browse, navigate to and select the desired image file.
Step 3: Click Open.
Recommended guidelines for a login page logo image are as follows:
• Height: 16-480 pixels
• Width: 16-480 pixels
Change the Login Page Background Image.
This setting allows you to change the background image on the portal login page. You can choose the
default Cisco background or upload a custom background image.
To upload a custom background image, complete the following steps:
Step 1: Select Upload New File from the drop-down menu.
Step 2: Click Browse, navigate to and select the desired image file.
Step 3: Click Open.
Customize the Banner Logo
This setting allows you to change the portal banner logo. You can choose the default Cisco banner or
Upload a custom banner logo.
To upload a custom banner logo, complete the following steps:
Step 1: Select Upload New File from the drop-down menu.
Step 2: Click Browse, navigate to and select the desired image file.
Step 3: Click Open.
Customize the Banner Background Image
This setting allows you to change the portal banner background image. You can choose the default Cisco
Background or upload a custom background image.
To upload a custom banner background, complete the following steps:
Step 1: Select Upload New File from the drop-down menu.
Step 2: Click Browse, navigate to and select the desired image file.
Step 3: Click Open.
Change the Login Background Color
This setting allows you to change the background color of the portal login page.
To change the login page background color, complete the following steps:
Step 1: Enter the color value as a RGB (Red Green Blue) hexadecimal value in HTML color format, such as the following: FFFFFF. Each pair of hexadecimal digits expresses an RGB value from 0-255.
Step 2: Click Show Color to display the specified color.
Customize the Banner Background Color
This setting allows you to change the banner background color of the portal. To set the login background color, complete the following steps:
Step 1: Enter the color value as a RGB (Red Green Blue) hexadecimal value in HTML color format, such as the following: FFFFFF. Each pair of hexadecimal digits expresses an RGB value from 0-255.
Step 2: Click Show Color to display the representative color.
Sponsor Settings
Customize the Content Background Color
This setting allows you to change the content background color for the portal pages.
To change the content background color for the portal, complete the following steps:
Step 1: Enter the color value as a RGB (Red Green Blue) hexadecimal value in HTML color format such as FFFFFF. Each pair of hexadecimal digits expresses an RGB value from 0-255.
Step 2: Click Show Color to display the representative color. -
ISE 1.2.1.198 - Guest Portal Configuration
Is it possible to customize the default portal and add a paragraph any where on the login page with instructions? I've tried adding the text in the Pre-Login Banner Text field, and it does wrap to the next line, but text goes of the screen before wrapping. Would like to be able to add carriage return in the text, so text would scroll off the screen.
ISE 1.3 (due out in November time frame) will have a huge amount of customization of the portal available for your use.
If you really need to do it before then, and you have an ISE-certified Authorized Technology Partner you're working with, they have access to a Guest Portal Builder tool that can be used.
Failing those, you're back to changing the native html code for the portal by hand. Not recommended. -
Hi Guy,
In my ISE deployment, once the guest succcesful authenticated will be assign guest VLAN for internet access.
we are using guest portal to do the vlan override once user authenticated.
Window 7 Internet explorer (Active X), Chrome (Java Aplet) is working fine.
but Android,Apple IOS devices unable to release the DHCP and get new DHCP.
because from ISE and WLC we can see the Vlan have change, how mobile devices initiate dhcp release for Guest Portal
Kindly advice.
Regards
FreemenI don't have such documentation nor I could find any on Cisco's site. With that being said, it doesn't mean that it doesn't exist. I just know that Active X is windows specific framework and Java is not supported on either iOS nor Android:
http://www.java.com/en/download/faq/java_mobile.xml
The good news is that Cisco appears to be steering away from Java so it is possible that in the future this will be supported.
Hope this helps!
Thank you for rating helpful posts! -
ISE Domain Name, Certificates and Guest Portal
Hi everyone,
We have an ISE deployment using our internal domain for its FQDN (For example: ise01.private.local). We now want to use it for authenticating guest access and have noticed the redirection URL by default uses the FQDN of the ISE server.
This works fine for our corporate machines as we have our own internal CA and generated certificates. As we do not want certificate errors occurring for our guests, we need to use a public FQDN.
Are we best off changing the domain-name used by the ISE servers or is there a way to edit the redirection URL to use a custom domain?
I have heard suggestions that changing the domain-name is unsupported, but I can't find any other way.
Thanks,
MarkMark,
Do you already have a public FQDN pointing to your ISE? If so, let's assume that you are authenticating guests using CWA. First creat a new Authorization Profile, under Common Tasks, select Web Redirection (CWA, DRW, MDM, NSP, CPP), Choose the Authentication Method (in this case, CWA) and define the ACL to be used. Just below that, select Static IP/Host Name and enter the public FQDN that points to your ISE.
From here you can create an Authorization Policy to reference the profile you just created.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton -
ISE Guest Portal - Error Resource not found
Hello,
When I create a guest user through the sponsor portal, then try to login with this guest user through the Guest Portal, after I press login button, the following error message occurs and do not know what to do to solve.
Error: Resource not found.
Resource: /guestportal/
None of the messages on the forum about it helped me to solve the problem.
I am using ISE 1.1.3.124 and this is a new re-image appliance.
Can anyone help?Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again. -
How to use ISE Guest Portal for AD users
Hi there,
As subject explains all, I want to use ISE Guest Portal for my domain users. I have tried many different ways to authenticate users and finally I came to the conclusion that ISE CWA works pretty well and is very stable. WLC Webauth sucks alot, does not redirect to the login page always.
Can you please share what other ways are stable ways to authenticate AD users? I know about WPA 802.1x authentication but that requires a CA in the network which is not available at the moment. So can you please Suggect?
Otherwise, I want to use ISE Guest Portal for my AD users as well. AD is already integrated to ISE, the issue happens when I attempt to athenticate using AD user account, the user gets authenticated but the Guest Portal redirects me to Device Provissioning page and there it shows an error saying "there is not policy to register the device, contact system admin"
Am I missing something??
I am running WLC 5760 with ISE 1.2
Thanks in advance..Hi,
Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
Thanks,
Tarik Admani
*Please rate helpful posts* -
ISE 1.3 Sponsored Guest Portal Login Failure
Hello Team,
Ive created a guest account in the sponsor portal for a test guest user, however the state remains in "created" state.
Now when the user tries to log on via the sponsored guest portal the error back is "invalid username or password".
In ISE logs it says :
Overview
Event
5418 Guest Authentication Failed
Username
bnawaz01
Endpoint Id
Endpoint Profile
Authorization Result
Actions
Troubleshoot Authentication
View Diagnostic Messages
Audit Network Device Configuration
View Network Device Configuration
View Server Configuration Changes
-->Authentication Details
Source Timestamp
2014-12-24 08:49:05.551
Received Timestamp
2014-12-24 08:49:05.553
Policy Server
DC1-ISE-DMZ01
Event
5418 Guest Authentication Failed
Failure Reason
Account is not yet active.
Resolution
Root cause
Username
bnawaz01
User Type
GuestUser
Endpoint Id
Endpoint Profile
IP Address
Authentication Identity Store
Guest Users
Identity Group
GuestType_Contractor (default)
Audit Session Id
Authentication Method
PAP_ASCII
Authentication Protocol
PAP_ASCII
Service Type
Network Device
Device Type
Location
NAS IP Address
NAS Port Id
NAS Port Type
Authorization Profile
Posture Status
Security Group
Response Time
Any ideas why this might be, if im doing something wrong and how to fix?
Thank you
BilalI have had the same issue, the fault is caused by the time zone in the sponsor groups being set by default to UTC, so if you are in London the accounts wont become available until UTC time. The best practice is to add a local time zone and remove UTC at initial configuration
To resolve this create a new local time zone in Guest Access>Settings>Guest Locations and SSIDs then under Guest Access>Configure>Sponsor Groups amend the time zone properties in each sponsor group
One other problem is if you do not remove this at initial configuration you don't seem to be able to get rid of UTC, not really an issue unless you forget when creating new sponsor groups -
Cisco ISE Guest Portal - DNS Issue - External Zone
Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.Robert,
Manual assignment has been made available in ISE 1.2 release.
M. -
Cisco ISE 1.2 Guest Portal customization with vWLC redirect
Hello Support Community,
we have a problem regarding customized web authentication on ISE 1.2 with Package ISE12CustomPortalPackage-v4.zip. We have a Virtual Wireless Controller where we do a redirect to ISE. When we use default guest portal on https://x.x.x.x:8443/guestportal/Login.action authentication and authorization works fine. When we do redirect to Cisco templates on https://x.x.x.x:8443/guestportal/portals/example/Login.html customized login page is displayed and after correct authentication guest successful page is displayed but we can't go to any webserver although ISE shows authentication and authorization as successful. When we try to reach a webserver after successful authentication we get redirected to customized login site. Virtual Wireless Controller shows client aus "Webauth Required" after successful authentication. Central Web Authentication isn't possible because we have a different AAA Server for 802.1X and only use wired guest access on a particular VLAN from WLC. Are there any known issues regarding customization template or is there something wrong regarding our redirect?
I hope somebody can help us.
Best Regards
BenjaminHello Neno,
1. I attached screenshots below.
2. There is nothing related to this client.
3. I attached Debug below.
We are currently using MAB on our switches as a fallback to our 802.1X on our wired access. Order and Priority currently is 802.1X/MAB/Auth-Fail-VLAN. CWA is based on a failed MAC-Authentication which leads to an Authorization Profile to permit access with Webauth.
If you configure Wired guest access on WLC there isn't a possibility to configure MAC-Authentication.
CWA on our switches isn't possible because we are currently using failed MAC-Authentication to direct clients to our Auth-Fail-VLAN which has restricted access secured by SVI-ACL which allows us HTTP Access to printers (manual Cert Deployment) and automated Cert enrollment to our computers.
Best Regards
Benjamin -
Pb to reach ISE Guest portal due to DNS constraints
I have set up a Guest Portal with WLC 5508 7.4 and ISE 1.1.1 ;
everything is OK, except one thing :
the Guest VLAN, associated to the Guest SSID is, actually, a DMZ behind my customer firewall and the DHCP parameters provided to the wireless Guest equipement connected on this VLAN include the public ISP DNS servers addresses, not the customer internal DNS serveurs addresses;
this seems OK since the idea of this Guest SSID is to give a pure Internet access to the Guests, and no connection at all towards the customer internal servers;
the problem is that, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this internal DNS name by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
Apart from changing those DNS values in the DHCP server (the customer does not accept this solution), how could we solve this problem ?
I have tried to code manually , in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://192.168.1.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa,
but, it does not work, since the sessionIdValue variable is not replaced by its real value when sent to the wireless client
any comment welcomedWe had the same issue. Our solution was to advertise the internal IP address from our external facing DNS server and let it propagate publicly. Our ISE box is in a DMZ and the firewall rules do not allow outside traffic to it, however the clients will get the correct internal IP address and since they are already inside the firewall on the DMZ segment they are able to get to the ISE box with the publicly resolved internal IP address. The other option we entertained was a firewall DNS redirect. That would work by intercepting the DNS request for that specific URL and return the proper internal IP, all other DNS requests would pass through to the public DNS server.
-
ISE Guest portal digital public certificate with dual deployment
I have a deployment of ISe which has a primary and secondary node. We are using ISE for Guest web access and it's Guest portal functionality.
I have installed a public VeriSign certificate onto the primary node so that guest users don't certificate errors when they get redirected to the guest portal.
We have a DNS server with an entty for the guest portal URL e.g. guest.company.com with the IP adresses of both ISE servers.
When users are loggin onto the guest wireless it is pot luck whether or not they get the primary ISE node because of the DNS round robin of the ISE IP addresses.
Is there anyway to make the secondary ISE node use the Verisign certificate as well or do I need to buy another certificate which is linked to the secondary ISE nodes FQDN?
(the certificate I have currently has a CN of the FQDN of the primary ISE server with subject alternative names of the secondary ISE node and the guest web redirect URL).
Any help would very much be appreciated.
thanks
CraigHi Craig,
Please check the below link with a similar prob, might help.
https://supportforums.cisco.com/thread/2161878
Maybe you are looking for
-
2 iphones using 1 iTunes account - iCloud transition?
My wife and I use the same iTunes account for both of our iPhones. I am concerned about what will happen when iCloud is launched. Will the contacts, calendars, bookmarks, email accounts etc all merge, or will one of us lose our data? I don't think it
-
The condition record for use B can not be displayed
Hi gururs, What does this message (number : VE896 ) mean ? How to make it desapear ? P.S : it's about output type for purchase orders. This message is displayed when I click on : "Goto -> Determi analysis" in tcode ME22N. Regards, Bahia.
-
Application Pages asking credentials in SharePoint 2013
Hi All, I am facing problem as Application Page is asking for the credential in SharePoint site where anonymous access enabled. I have enabled the anonymous access while creating the web application and also given full access to the website for anony
-
When I go to history it only get the history for today, how do I get all history to appear
I am trying to get all history instead of just the history of today. I want all the history to appear.
-
Transferring photos in more than one folder from PC to iPad using iTunes
In iTunes, if I sync photos in folder "A" on my PC with iPad and at a later time sync with folder "B" on the PC, will the photos that were originally synced with folder "A" be erased from the iPad?