ISE 1.1/WLC 7.2 Wireless MAB and Profiling

I am trying to set up wireless MAB with CWA so that when devices connect to the open guest network they are profiled and if they match a device type (iphone, android) they are allowed access to the internet without AUP or Authentication and all other device type (including unknown) is redirected to the guest portal for authentication. My configuration works when devices are correctly profiled, the issue is that it appears that the RADIUS probes are the only profiling components working on the guest side. Devices are being correctly profiled on the corp network segment. The key profiling components I need to get a match on iphone is DHCP and HTTP user agent. Without those all iphones are categorized as an apple device and not iphone. I suspect this is because they are matching the MAC OUI from the RADIUS probe and MAC filtering with NAC RADIUS on the WLC. The ISE is on a seperate LAN from the guest and right now I am only allowing DNS and 8443 through the ASA. I also believe DHCP profiling is not working because the guest DHCP is running on the WLC internal DHCP and is not forwarding requests to the ISE for inspection because it will not relay the request to 2 servers, it just uses a secondary if the primary is unreachable.
Can someone point me in the right direction? I believe my Authentication, Authorization, and Identity Source Sequence, etc configuration is correct, but can post additional details if necessary. My main issue is the profiling probes and getting them working correctly on the guest LAN.

What we did to get around this was to adjust the profiler policy for Apple-Device to take network scan action when MAC:OUI contains Apple. So basically the device connects to the wireless network, MAC filtering on the WLC identifies the OUI to belong to Apple and initiates an NMAP scan that properly identifies the OS of the iDevice. This allows iPhones to connect and other Apple devices like iPads to be redirected to the login portal.
We can also make similar adjustments to Android and other devices that require profiling to properly identify the device type. In this case, allowing SmartPhones to connect directly to the internet and all other devices to be redirected to the portal.
Hope that helps.

Similar Messages

Cisco ISE 1.2.1 deplyomet issue with Anyconnect and Profiling

Hi All,
We are running cisco ise box in 1.2.1 version wherein I am facing below issue while deployment. We are having two ISE boxes where One box act as Primary Admin,Secondary MNT and Policy Service and Second Box act as Secondary Admin,Primary MNT and Policy Service
1) Profiling of Endpoints - HP Laster jet printer 55XX series and scanner profiling are not happing in Cisco ISE 1.2.1 wherein I have enabled below probes in ISE for profiling
RADIUS Probe
SNMP Probe SNMP Trap HTTP Prob and DNS
2) Any-connect issue - We are using any-connect supplicant 3.0.11042 for wired and wireless user profile in windows 7 enterprises 32 bit machine
- Yellow mark issue -  Once authentication , posturing completed we are getting yellow mark on network drive but still we are able to connect to network
- Network Map Drive issue -  Once authentication , posturing completed we are getting red cross mark on Network map drive and if we double click on that drive then its get accessible and red mark turns in to green.
For that we have already allowed Ip level access to all domain in before logon dacl ( Machine authentication )
That would be really great if any one can help me on the same.
Thanks & Regards
Pranav

Hi Pablo ,
Please find below solutions
Yellow mark issue - - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet. This Service is by default disabled on Windows XP and Widows 8.X operating system. This is only enabled by default on Windows 7 and Windows Vista operating system.
Network Map Drive issue   - Create logon script and deploy it using group policy. Script will check full network connectivity and then map network drives
Regards
Pranav

ISE/Wireless NAC...One SSID for MAB and Dot1X?

Hi,
I am running ISE 1.2 and WLC 7.5.102.
I would really like to have one SSID that can do a few different things in the following order...
1) A device could connect, hit the MAB rule, and be granted access without any type of authentication (Other than MAB) and be placed in VLAN x.
2) A device would be checked for the appropriate certificate. If this cert exists, the device is granted access.
3) If a device is not allowed in MAB, it will hit the next rule, which is the dot1x rule. The user will then be authenticated against the AD server.
4) Everything else hits default rule and is sent to web-auth portal.
I can't really think of a way to make this work with one SSID because from what I understand, you would need dot1x disabled on the SSID in order for MAB to work.
Any suggestions?
Thanks.

two ssid's. no way around it

ISE Airespace ACL WLC problem

Hello,
i've configured ISE and WLC to use guestportal with CWA but there is a problem with CoA -- it doesn't want to apply airespace alc after auth at guestportal.
1. At authC page i've configured a wireless MAB to continue if user not found and to use a Internal users as a identity store.
2. At authZ page i've configured a WEBAUTH as a default rule with the following:
Access Type = ACCESS_ACCEPT
cisco-av-pair = url-redirect-acl=ACL-WEBAUTH-REDIRECT
cisco-av-pair = url-redirect=https://ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
3. I've also configured this ACL at WLC to permit
permit dns and icmp any-any
permit any-to-ise-8443
permit ise-to-any
This part works fine because i able to redirect to guestportal and use my guest login&pw to authorize myself. The guest account was previously generated through sponsor portal and it's working too.
4. At authC page i've use a wireless dot1x to use Internal users
5. At authZ page i've use a "if internal users:Guest then GUEST permission" rule
6. GUEST rule looks like the following:
Access Type = ACCESS_ACCEPT
Airespace-ACL-Name = GUEST_INTERNET_ONLY
7. This ACL is configured on the WLC permitting any except private networks (ISE is also permitted)
After guest portal auth i see a success message and i able to ping internet but i have no web access to it. It looks like CoA and Airespace acl are don't working and i keep using my ACL-WEBAUTH-REDIRECT access-list and i see a strange error messages in the WLC logs:
*apfReceiveTask: Nov 12 17:32:27.317: %ACL-3-ENTRY_DONOT_EXIST: acl.c:369 Unable to find an ACL by name "".
I swear my ACL name spelling is correct and both ACL-WEBAUTH-REDIRECT and GUEST_INTERNET_ONLY are on the WLC with their counters growing!
I don't have a point what issue it could be...
Any ideas?
P.S. see attach for Live authentication log

Thank you guys for your responses, it's working now!
The first problem was there:
Changing IPv4 ACL 'none' (ACL ID 255) ===> 'GUEST_INTERNET_ONLY' (ACL ID 5)
There are only 3 ACLs on my WLC so ALC ID 5 is kinda suspicious -- after WLC reload it becames ACL ID 1 but the problem was unresolved.
After that i changed my authZ matching rule to use another authZ profile:
Access Type = ACCESS_ACCEPT
Airespace-ACL-Name = PERMIT_ALL_TRAFFIC
cisco-av-pair = Airespace:Airespace-ACL-Name
Then i created ACL PERMIT_ALL_TRAFFIC on my WLC with one ACE "permit any any". I also denied access to my private networks at ASA where guest vlan's gateway resides.
I think the problem was in WLC's GUEST_INTERNET_ONLY ACEs which denied traffic to my private networks.
Thanks for the help!

Cisco ISE 1.3 failed to authenticate wireless endpoint

Dear all,
I recently have a big problem of my ISE after upgraded from version 1.2 to 1.3, the original plan is follow for wireless laptop authenticate to our network.
There are 2 SSID, REG and INT, when the user and laptop first time use the WIFI, they need to request a user certificate from CA, and they need to login to the REG SSID with AD username and password. The Wireless controller 2504 will pass the packet to ISE, the use will use 802.1x authen method with PEAP to request for cert. if the authentication successful, the user need to open a web browser and the NSP page of ISE will shown up for user to register, and the CA will generate the user cert to user. Then the SSID will switch to INT and using EAP/TLS to authenticate the user cert with the CA.
That was fine when working in ISE 1.2. However, after upgrade to 1.3 because of the proxy setting in 1.3 allow to input username and password which our proxy server required and cannot be changed. Under 1.3 the authentication failed even in the first step of authentication policy of ISE, the policy will check if the laptop using 802.1x and login by AD account, then it will pass to authorization policy. But when I check the log, there is always have the error message 5411 Supplicant stopped responding to ISE , 12930 Supplicant stopped responding to ISE after sending it the first PEAP message , 5440 Endpoint abandoned EAP session and started new
I have search long time in the Internet but without any help, appreciate if any expert can help me. I have also upload the debug message from our ISE for reference.
Thank you
Best Regards,
Terry Chow

Hi Terry,
Just wondering if you got an answer to your problem?
I am deploying a new solution with ISE 1.3 and I was having a similar problem with my wireless users when I tried to enable it last night
Cheers,
John

ISE 1.3 / WLC 8.x + Server 2012 R2

Hi All,
Just wondering if anyone has seen this issue and if so – a solution or any advice would be great!
Scenario.
ISE 1.3 is connected to Server 2012(R2) AD – and this is showing as connected and all tests are successful.
ISE is Connected to WLC 8.x (Tests on attachment showing succesfull)
The permissions of the service account I used for ISE to link in with AD – "domain admin" and also tried "domain users" (using domain users now) and we can see AD security groups etc
- WLC is succesfully connected to ISE
SSID "Test" is configured to send to AAA - ISE
ISE has a policy that permits "domain users" on the network.for web authentication
Issue I am experiencing is when I connect to the SSID I get prompted for a login - this is my domain account it’s looking for
(my account is a member of domain users only)
===============================================
I get a message on BYOD Portal (SEE ATTACHED SCREENSHOTS)
“Unable to obtain the user information needed for network access. Try again”
===============================================
If I use an account that has domain admin rights – everything works fine every time?? and I can start the process of registering my device on the network??
I would like to rule out AD if i can. (Win Server 2012 R2) -
everything looks ok from ISE as we can see AD groups etc when you select "retrieve AD groups" - i can see all built in groups etc ....
We get authenticated fine - the issue appears to be in the web-redirect and it seems like you need to be a domain admin for us to get the correct registration page.
Any help would be great
Thanks
James

HI David
Many thanks for your response.
Yeah I have tried different users and also on ISE different groups and cross checked the SID on ISE groups to the SID on the AD group and seems both match.
My colleague is doing the ISE part and I am doing the Windows 2012R2 part and all looks ok – the service account seems to be testing out fine when running tests on ISE and displaying groups etc when I "retrieve groups from AD" (from ISE)
The finger at this time seems to be pointing at my AD …due to the domain admin accounts working and domain users not (I know these are both domain users but as my colleague is the “boss” I just need to make sure 110% that there is no special requirements that I need to add to the computer account & or the user account
From the Cisco doc’s the service account just needs to be a domain user to read AD but is there anything special with the ISE computer account? – At this time the ISE computer account is in the default computer OU and the ISE service account is in the.
After removing and re-adding and double checking the groups (External Identity Stores > Groups) both SIDs match on both domain users group
When I connect to the SSID I initially get prompted for a username and password then –
The BYOD Portal splash page just says BYOD Welcome “Unable to obtain the user information needed for access. Try again. (If I use a standard user account member of “domain users” only BUT if I use my domain admin account when joining the SSID (member of domain users + domain admin) I can start the process or registering my device and I can proceed through the required steps 1,2,3,4 until I access the web
Standard “domain user” I can’t get by step 1 as I get the “Unable to obtain the user information needed for access. Try again” message
The boss says this SSID is stripped back to just domain users and asks the question why does domain admins work?? - Hence Server AD getting a finger pointed at it.
Regards
James
I have uploaded some picts that may assist & thanks again.

DMZ Anchor WLC setup for Wireless Guest Access

I have the following setup.
A DMZ WLC 4402 connected to firewall DMZ interface in 10.10.73.0/24 network.
An Inside WLC 2106 connected to firewall Inside interface in 10.10.71.0/24 network.
Both WLCs are running the same 4.2.176 code.
DMZ WLC is anchor to itself and Inside WLC select the DMZ WLC as the anchor point.
I have setup EoIP between DMZ and Inside WLCs successfully with both the control and data path both show as UP status. >> "show mobility anchor"
The main issue: Clients cannot obtain IP addresses after connected to Guest SSID.
1. Inside WLC, the guest WLAN ingress is 802.11b/g radio and egress port is set to management interface (EoIP) of type WLAN.
What is the DMZ WLC setting? Is the ingress set to "802.11b/g" which does not make sense because the ingress is EoIP from Inside WLC?
Or I still set as 802.11b/g? Same config as Inside WLC? I read from other threads suggested by Terry that the config must be the same for both WLCs.
In the Inside WLC, I saw alot of pdu encapsulation errors for broadcast packets which is ffff.ffff.ffff xxxx which I think is the DHCP request from the connected Wireless clients not making through the EoIP tunnel. I have set static ip for the Wireless client but the packets cannot route through the EoIP tunnel to the far end.
2. DHCP server is provided by DMZ WLC with the scope 10.10.76.0/24. In the Inside WLC, which DHCP server IP adddress to set to? DMZ WLC mgmt ip address? DMZ WLC, the DHCP server is also set to DMZ WLC mgmt ip?
3. Layer 2 authentication. I read that DMZ WLC is supposed to be the DHCP server, Layer 2 or 3 authentication for Wireless Clients. However, it seems like Inside WLC is required to configure the Layer 2 authentication parameters and the DMZ WLC is set to providing the DHCP service?
4. Lastly, anyone has done DMZ WLC sending the Wireless clients traffic to Bluecoat proxy server before hitting the Internet?
Thanks.

One of the biggest things is to make sure the wlan is configured exactly the same. The DMZ WLC ingress is the management and also is the egress port. You can create a dynamic interface on the DMZ WLC, but this way makes thing easier. The DMZ WLC should provide the dhcp, so the dhcp scope of course will be on the same subnet as the management of the DMZ WLC. The DHCP Server will be the ip address of the management interface of the DMZ WLC. The authentication also has to be configured exactly the same on the inside wlc and the DMZ wlc. Since you are pushing clients through the tunnel to the DMZ WLC, that is where clients will need to get their ip address, since that DMZ WLC has a network interface to the guest network. I haven't had luck when a proxy is involved, but I know there was a post a while ago on how to setup the proxy to allow the wlc to bypass the users initial dns resolution.

If anchor WLC fails, roaming wireless users get "stuck"

I did a test in our lab where I roamed from an AP on WLC A to an AP on WLC B. My client kept its same IP address and connectivity remained. I'm running WLC 4.0.219, so the traffic at this point was not symetrical, but the connectivity was up. WLC A was the Anchor WLC.
Then, I failed WLC A. My wireless client still had its original IP address from WLC, so I lost all connectivity. WLC B did not try to anything so that my client would get a new IP address (from WLC B) and regain connectivity.
The only way I could get my client to work again was to go to WLC B and "Remove" the client. It looks like this forced the client to re-authenticate and get a new IP address.
Is this the only way to get a client back on the network in this type of failure scenario?

Did both WLC's have dynamic interfaces on the same subnet or did each WLC have interfaces on different subnets. I have tried this failure before with no issues, as long as the WLC have interfaces on the same subnet for the users.

Question about Wireless Design and Controller

Hi Everyone,
Although I am not new to Cisco, I have somewhat limited experience with Wireless in general. I was hoping to get your help with the following:
We currently have a total of 8 1130AG, 4 on each floor. They were configured a few years ago, and now we are looking to update the design a bit. Each AP has its own SSID, and just provide internet access. Looking at the configuration, I noticed that they are not configured to use proper channels, just random channels (9, 10, 11, instead of 1, 6, 11, etc.). I noticed that when I roam between one AP to another, I lose about 4-8 pings before I re-establish connectivity again.
Here are my questions:
1. Do I need a controller in order to use just one SSID for the whole setup instead of the 8 seprate ones we currently have?
2. Will the controller helps in providing seamless transition when a client roams between AP's?
3. Is it normal to loose connectivity roaming around?
4. Can I reconfigure the current setup to use just one SSID and provide better transition between AP without the use of a controller?
5. Which controller would you recommend?
We don't have a need to anything fancy ,I am aware that I can enable multiple SSID, VLAN's, etc. Just trying to keep it as simple as possible, yet reliable.
Your input is appreciate.
Thanks

1. With 8 AP's only, a WLC would be nice-to-have but not necessary. You can configure WLSE and it will do some limited functions.
2. This depends on the signal strengths, wireless coverage and configuration. If you enable WLSE, for instance, and you have no wireless black spots, then roaming should be no issues.
3. See #2.
4. You can configure multiple SSID (up to 16 are broadcasted) but if one AP doesn't have the SSID you use for roaming, the association will drop when the client tries to join that particular AP. It's like mobile phone towers. If your carrier is not in the area, you sure won't be able to use your mobile phone in that area.
5. For 8 1130 APs, I'd recommend the smallest of the lot: 2106 with either 6, 12 or 25 AP licenses. I'd recommend you the 25 AP licenses. If your finances allow you something bigger, then consider either the 4402 (25 AP licenses) or the 5508.
Cisco 2100 Series Wireless LAN Controllers
http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps7206/ps7221/product_data_sheet0900aecd805aaab9.html
Cisco 4400 Series Wireless LAN Controllers
http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps6307/product_data_sheet0900aecd802570b0_ps6366_Products_Data_Sheet.html
Cisco 5500 Series Wireless Controllers Data Sheet
http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps10315/data_sheet_c78-521631.html

Wireless modem and Airport Express.. one at a time

Recently my internet provider upgraded my old plug in modem to a newer wireless model. Now it seems that the current setting allow communication with only one or the other at the same time. If I want to be online with the wireless modem and send my iTunes music via Airport Express to my sound system, no dice. I have to either click on the modem up in the Airport choices to be online and listen to iTunes through the computer speakers, or go offline to listen to music through the sound system and Airport Express.
I'm sure I'm just missing something in preferences or settings somewhere.
Can someone point me in the right direction?
Thanks, and Happy New Year!

No ideas?

The Difference between Extending a Wireless network and WDS?

I have an Extreme (n) and an Express (n).
I want to make sure the signal is strong upstairs and share a printer (connected to the express) and use AirTunes. I also may add an external drive to the Extreme.
What's the difference between Extending a Wireless Network and using WDS? Will there be a speed difference?
Message was edited by: J. Christopher Edwards

I think you don't get it
If I have another draft N router that operates at 2.4G and I have only n devices I can still use WDS and it will connect using draft n in the 2.4G band.
If one g device connects to the network will go in mixed mode.
The AEBS will still report 130 Mbps for your n clients and 54 for your g clients.
If the other router is g only obviously you can't connect between the two router at n mode but still the AEBS will be in mixed mode and not in g. The Extreme will still report 130 Mbps for the connected n clients.
I can tell you that because I have actually implemented it am not taking off the documentation.
The same device if I try to use the "extend n network" does not even see the AEBS but will happily keep the n in the WDS mode and though the bandwidth is halved it is still more than g.
In any case enough for this!

Suddenly My iphone 4s does not find my wireless printer and sometimes can't find the server.

All of a sudden My iPhone 4s cannot find my wireless printer and cannot connect to the internet all of t he time.

Hi dbutkow,
If you are having Wi-Fi or network connectivity issues, you may want to take a look at the troubleshooting steps outlined in this article:
iOS: Troubleshooting Wi-Fi networks and connections
http://support.apple.com/kb/ts1398
Cheers,
- Brenden

Wireless network and bluetooth not working on touchsmart 600

This has not worked since day 1 and I have been using wired internet.
I really need to setup a home network and need to use wireless.
Research on the net has led me to belive I should have HP WIRELESS ASSISTANT on my machine... is that correct?
Everytime I try to download it is seem to be for a notepad... mine is a touchsmart desktop...
Please advise

Hi coffee12345,
Welcome to the HP Forums!
I have read your post on your wireless keyboard and mouse not working with your desktop, and I would be happy to help you! To begin, I need to ask you a few introductory questions:
What is the Product and Model Number of your desktop?
What version of Windows are you using?
Is this a recent issue, or has it been like this since day one?
Are you using a USB hub to connect your peripherals or is it directly plugged into the computer?
Please re-post with the necessary information, and I look forward to your reply!
Regards
MechPilot
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the right to say “Thanks” for helping!

Issues with Home Hub 3 Wireless. And lousy teleph...

I don't know if this forum is moderated or followed by BT support staff, but I sure hope so.
After coming from Virgn Media for my BB to BT infinity (Awesome speeds btw!) I'm pleased with the connection and, up until today, the support. I now have issues with my Wireless devices on the HH3.
This is the outline of my setup:
I have the Open reach modem connected to the home hub. I then have the 1Gbps ethernet port from the home hub that is connected to a 1Gbps 5 Port switch that connects my wired network together (Consisting of my Xbox, Networked Printer and my Desktop PC). Wireless serves 2 Laptops, an Xperia U phone, and a G5 Ipod touch (not all mine, I have a flat mate).
My issue is that when more than one device connects via WiFi, the WiFi network has serious issues: The connections don't drop per se, but websites are not delivered, data transfer is intermittant at best - i.e. the WiFi network simply does not work. When there is only one device, there is no issue.
Now, being a techie (I don't mean to title drop, but I think it's important that technical support know that I know my stuff) I'm an electrical engineer (The graduate type) and I know my IT - so I have my own idea of what's wrong with this.
Now, as my order was not completed until yesterday, techincal support couldn't/wouldn't help until today. Yesterday, however, I spent hours trying to solve my issues and got as far semi-solving the problem. I managed to get everything working nicely together when Wireless N is disabled and only a/b/g is enabled. Great, but a main selling point is the Wireless N and I want to use this.
So, today I phoned technical support. I should also note here, and I made this perfectly clear with support, that when the WiFi starts to missbehave, the wired network still works perfectly and I have no issues with internet connectivity with any wired devices. So, clearly this is not a line fault - it's on this side, aka, the router WiFi side where the problem resides. Support decided to do a line test anyway - and of course it got the all clear. He then asked me to reset the router (Yey, again after I had done it plenty of times before, only this time I had customised the SSID and the LAN IP addresses and now they need done again). He then went on to state that I should receive an e-mail with instructions on what to do next, and if they are still issues to reply to a text message that will be sent.
Duly, an email arrived. It began with "Sorry you had to call us today about your wireless disconnecting. We’re pleased we could help you get it working again." and continued on with with this theme. No, my problem is not resolved! I phoned back, this time advising me to change channels, and check individual devices to see if they're any conflicts - I did this pretty quickly and disabled and re-enabled WiFi on my Laptop, phone, ipod and still to no avail.
I have now been told that I will get a phone call between 3 and 3:30pm to see if the WiFi will settle down. huh!
I don't mean to be such a pain and sound like such a git, but this is not an issue that I believe the technical support (via the call centre anyway) will be able to solve. This is an issue with the HH3, mine at least, not being able to handle mutiple WiFi devices conntected simualtaneously - all but one on N, the other on G. Now, I'm of the understanding that this shouldn't be a problem. I'm sick of telephone support going through their script without listening to the whole issue either or beleiving that I spent a good 2 hours yesterday getting to the bottom of this. I don't need line tests, I don't need resetting the router, I don't need changing channels - I've did all this!
So it looks as though I'm stuck on HH3 in 'G' for now until we solve this issue.
Further information: I'm using the type A HH3; again wired devices are not impacted in any way from this issue; I have tried multiple different channels; YES! I've reset the router and power cycled it; And this issue happens wether my WiFi devices are 1 meter away from the HH3 or 15 meters away.
Could this be a bad HH3 or frimware issue? Can someone suggest something or highlight something that I've perhaps overlooked or missed?

This is only a customer to custome help forum.
This link may help, although some of the things you may have already tried.
Wireless can prove quite unreliable, and an separate wireless access point can help.
Wireless connection problems
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

TS3048 My early 2009 Mac Pro does not connect via bluetooth to my sound bar or bluetooth mini speakers. Both my wireless keyboard and mouse have no problems connecting. What do I need to do to connect to external bluetooth devices?

My early 2009 Mac Pro does not connect via bluetooth to my sound bar or bluetooth mini speakers. Both my wireless keyboard and mouse have no problems connecting. What do I need to do to connect to external bluetooth devices?

I would always have a wired keyboard and mouse on hand (need not be expensive ... any cheap wired devices will work). "Emergency recovery" procedures can activate features in random order, so the opportunity to select a recovery partition may pass before the wireless devices are recognized.
That will let you select the "turn on Bluetooth" icon.

ISE 1.1/WLC 7.2 Wireless MAB and Profiling

Similar Messages

Maybe you are looking for