ISE 1.2.1.198 Wired - Central WebAuth Fail

Hello, I have a trouble with WebAuth.
I follow this guide to implement this, but it does not work.
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/113362-config-web-auth-ise-00.html
Port Redirection is working, because when I am trying to access any page, and open guestportal.
After GuestPortal is open, I set user/pass on the webpage.
user: webauthuser
After this, display the page Self-Provisioning Portal "Welcome webauthuser" but with the error "The system administrator has either not configured or enabled a policy for your device. Contact your system administrator".
I have this Authorization Profiles
On Operations / Authentication, I have the following...
Event 21:28:21.801

Partner help to troubleshoot this. It was fix.
Uncheck "Enable Self-Provisioning Flow" on
Administration > Web Portal Management > Settings > Guest > Multi-Portal Configurations > DefaultGuestPortal > Operations
Tks.

Similar Messages

ISE Wired Central Web Authentication no url redirect

We are setting up ISE for wired guest accest but are having trouble with the client being redirected. The switch gets the download from ISE and shows that it should use the URL redirect with the correct ACL.
ISEtest3560#show authentication sessions interface fastEthernet 0/2
            Interface: FastEthernet0/2
          MAC Address: 001d.09cb.78bd
           IP Address: Unknown
            User-Name: 00-1D-09-CB-78-BD
               Status: Authz Success
               Domain: DATA
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: multi-auth
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
              ACS ACL: xACSACLx-IP-ISE-Only-52434fbe
     URL Redirect ACL: ACL-WEBAUTH-REDIRECT
         URL Redirect: https://REMOVED.Domain.corp:8443/guestportal/gateway?sessionId=0A0003E600000039064485B1&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: 0A0003E600000039064485B1
      Acct Session ID: 0x00000293
               Handle: 0x95000039
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
From the client pc I can get name resolution for anything I ping. I also can ping the ise server by name. The ACL that is downloaded it as follows:
Extended IP access list xACSACLx-IP-ISE-Only-52434fbe (per-user)
    10 permit udp any eq bootpc any eq bootps
    20 permit udp any any eq domain
    30 permit ip any host 10.4.37.91
    40 deny ip any any log
Extended IP access list ACL-WEBAUTH-REDIRECT
    10 deny udp any eq bootpc any eq bootps
    20 deny udp any any eq domain
    30 deny ip any host 10.4.37.91
    40 permit tcp any any eq www (13 matches)
    50 permit tcp any any eq 443
    51 permit tcp any any eq 8443
    60 deny ip any any
The machine passes the Authentication with MAB and hits the CWA Authorization profile, ISE shows the cient as "Pending" then the next entry above that is the log is the dACL getting pushed to the switch. Could part of the issue be that the device shows Unknown for IP address? The command ip device tracking is in the swtich:
ISEtest3560#show running-config | include tracking
ip device tracking
ISEtest3560#
We have 802.1x clients working and the IP address for those do show up..
Please advise,
Thanks,
Joe

ISEtest3560#show ip access-lists interface fastEthernet 0/2
ISEtest3560#
Doesn't appear the dacl is being applied.
interface FastEthernet0/2
switchport access vlan 11
switchport mode access
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication event server dead action reinitialize vlan 999
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab webauth
authentication priority dot1x mab webauth
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
spanning-tree guard root
Extended IP access list ACL-DEFAULT
    10 permit udp any eq bootpc any eq bootps
    20 permit udp any any eq domain
    30 permit icmp any any
    40 permit udp any any eq tftp
    41 permit ip any host 10.4.37.91
    50 deny ip any any log (1059 matches)
Could the dACL being causing the issue with the Unknown, or is the Unknow causing the issue with the dACL?
Thanks,
Joe

Bug CSCup27305 in ISE 1.2.1.198 patch3

Hi guys,
I´m hitting bug CSCup27305 in version ISE 1.2.1.198 patch3 but cant find a fix version.
Do you know what version can be applied, so DACL can start with permit IP Host 2.2.2.2 Host 1.1.1.1 = is NOT ok!
Thanks a lot for your help.
Erick Flamenco

It is not resolved in any shipping version and will currently be in first release that ships post 1.3
Note that this issue impacts DACL validator functionality in that does not detect the invalid DACL as it should but does not impact any end to end functionality and so may not get priortized for any earlier patch

Webauth Failed Over

I'm attempting to use webauth as a fallback method for 802.1x for wired clients. I've configured the switchport as recommened in the documentation. Here's the snipped for the interface:
interface FastEthernet0/4
switchport access vlan 141
switchport mode access
authentication order dot1x webauth
authentication port-control auto
authentication fallback PROFILE-WEBAUTH
dot1x pae authenticator
dot1x timeout tx-period 5
end
The debugs seem to show that webauth fails over too quickly for it to be effective. Any ideas why this may be the case? Thanks.
Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
AHQSWTC02#
A
Aug 9 16:04:02.252 EDT: %DOT1X-5-FAIL: Authentication failed for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-5-START: Starting 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-FAILOVER: Failing over from 'webauth' for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
Aug 9 16:04:02.252 EDT: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (000b.97bc.c746) on Interface Fa0/4 AuditSessionID AC166431000000721EA9B20B
AHQSWTC02#
A

if my memory serves me well, you configure "dot1x timeout tx-period 5". So it means that the switch will send dot1x probes every 5 seconds, 3 times.
So after 15 seconds,it declares there is no dot1x capable laptop and it fails over.
I would suggest to increase the amount of dot1x retries or to increase the tx period.

Central build fails when checking in an activity

I have a web dynpro application that uses a javabean as model. The javabean has several properties that are of type collection that are mapped to DTOs that consist of simple types. I had to add a new simple type (integer) to one of the DTOs and made the same change in web dynpro by adding the integer property to the appropriate model class.
I did a reload + rebuild in web dynpro, dragged the new model attribute from the model to the component controller and added the attribute to my view. I then did a DC build and then a DC deploy and the application works. I can retrieve, update and add values from the database with the new field.
When I go to check my activity in, the central build fails and the failure is related to the new attribute that was added. Im wondering in the problem is related to problems with the NWDI server, as it was restarted several times this week while I had my activity open.
When I browse to the dev/inactive branch in the DTR, I can see the new attribute that was added to JobPartDTO.java class in the DTO DC and I can see the new attribute that was added to the JobPartDTO.wdmodelclass in the web dynpro DC. In the dev/active branch, theses changes are not present.
Here are the errors from the CBS log.
[echo] Starting Java compiler
     [javac] Compiling 73 source files to /usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/classes
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12771: cannot resolve symbol
symbol : method getOperSeqNo ()
location: class com.company.dev.jsets.dto.JobPartDTO
      return gen_modelInstance.getOperSeqNo();
                              ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12779: cannot resolve symbol
symbol : method setOperSeqNo (int)
location: class com.company.dev.jsets.dto.JobPartDTO
      gen_modelInstance.setOperSeqNo(value);
                       ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12791: cannot resolve symbol
symbol : method getOperSeqNo ()
location: class com.company.dev.jsets.dto.JobPartDTO
          return new Integer(gen_modelInstance.getOperSeqNo());
                                              ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12808: cannot resolve symbol
symbol : method setOperSeqNo (int)
location: class com.company.dev.jsets.dto.JobPartDTO
          gen_modelInstance.setOperSeqNo(((Number)value).intValue());
                           ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12820: cannot resolve symbol
symbol : method getOperSeqNo ()
location: class com.company.dev.jsets.dto.JobPartDTO
          return gen_modelInstance.getOperSeqNo();
                                  ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/wdp/IPublicJobSetsComp.java:12829: cannot resolve symbol
symbol : method setOperSeqNo (int)
location: class com.company.dev.jsets.dto.JobPartDTO
          gen_modelInstance.setOperSeqNo((int)value);
                           ^
/usr/sap/DJD/JC50/j2ee/cluster/server0/temp/CBS/eb/.B/10398/t/E63CF921E07C342BC77B3BB9E227D7A8/gwd/packages/com/company/dev/jsets/wdp/JobSetsComp.java:3052: cannot resolve symbol
symbol : method setOperSeqNo (int)
location: class com.company.dev.jsets.dto.JobPartDTO
               dto.setOperSeqNo(operSeqNo);
                           ^
7 errors

The problem has fixed itself! I made some new additional changes to my DAO and EJB and checked in my activity. This detected all the predecessors activities and central build was successful, even in the CMS!

ISE Central webauth and vWLC 7.4

Hi Everybody,
I am wondering if anyone has gotten this scenario to work, Cisco ISE Guest Portal via CWA redirect on an AP connected to a Virtual WLC running 7.4. As vWLC can only run flexconnect, and no centrally switched vlans are supported, how would this scenario be possible, if at all, the AP would have to do the redirect instead of the controller ?

Yes, I agree with Tarik
also do review the below link which might be helpful:
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_41_guest_services.pdf
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_40_webauthentication_dg.pdf

ISE 1.2.1.198 patch 5 - Operations Authentications not loading or displaying

Is anyone else having an issue with getting Authentications to display under operations? We were running 1.2.0.899 and started to run into a couple bugs so we upgraded to 1.2.1.198. Ever since then the Operations - Authentications have not been working right. I may occasionally see and actual authentication but not as many as I should. Most of the messages I saw yesterday pertained to radius processes already in progress from endpoint which was my wireless controller. Today I just get a loading data message at the bottom of the screen. It does not seem to be affecting system operation as users are still properly authenticating but I am unable to monitor the process or troubleshoot a users if they were to have an issue. We are on the edge of moving this into full production but really cannot until I get this resolved.
I have a case open with tac and their comment was that the issue of authentications not displaying was fixed in 1.2.1 and not sure what may be happening. We went ahead and applied patch 5 just in case there was something else going on. That did not fix things and it now seens to be getting worse.
I just wanted to see if anyone else had seen this and could possible shed some light on a resolution.
I am running a cluster containing the following. Primary admin on a VM - two policy Services servers both on VMs - secondary admin on retired ACS 2111 appliance. All three VMs are on the same physical server. Memory utilization on the admin server is just under 50% with the Policy servers both in the 30% range. I do have one policy server that is showing authentications in the 10-12ms latency but do not think that should affect anything. The ISE cluster is also tied into our 5508 wireless controller for support of the wireless networks. I have two SSIDs in production here at corporate and trying to figure out FlexConnect for the remote locations so we can centralize everything.
Brent

TAC recommendation was to install patch 5 which should include patch 4 plus other things. They took logs from my servers and asked to give them a day or so to look at the issue. Today is day three with no update.
I am going to reboot all the servers in the cluster tonight. I do not have console access to the VMs so am hoping that I can reload from the CLI and accomplish the same thing rather than just reload the services.
I tried a wired connection this morning and it popped into the authentications report but will have to test to make sure it repeats.
What is mostly in the log is simply the reports of the supplicant stopped responding to ISE. I know thought that I have at least 5 people that are connected via wireless. Here is a sample of what is in the log.

ISE 1.2 Patch 8 - Wired CoA Bug

Hi all,
Just wondering if anyone else is having CoA issues using patch 8 on wired infrastructure? I was troubleshooting CoA this morning in a 5 node deployment (1 x Admin, 1 x Monitoring, 1 x secondary admin/monitoring and 2 x PSN) and found that CoA was not working. I did a debug aaa pod and it said that POD message was dropped due to an unconfigured client and listed off the IP address of the primary admin node that I had initiated the CoA from (in the gui).
I thought this was strange in that I have always believed the CoA comes from the PSNs. I stopped the primary admin and did the same test using the secondary admin and the same error presented this time with the ip address of the secondary admin. I then proceeded to add the admin nodes as dynamic author clients and CoA started to work properly.
So in summary I am wondering whether this is a bug, a misunderstanding on my part or a change to the way that ISE CoA now works?

CoA Not Initiating on Client Machine
Symptoms or
Issue
Cisco ISE is not able to identify the specified Network Access Device (NAD).
Conditions Click the magnifying glass icon in Authentications to display the steps in the
Authentication Report. The logs display the following error message:
• 11007 Could not locate Network Device or AAA Client Resolution
Possible Causes • The administrator did not correctly configure the Network Access Device
(NAD) type in Cisco ISE.
• Could not find the network device or the AAA Client while accessing NAS by
IP during authentication.
Resolution • Add the NAD in Cisco ISE again, verifying the NAD type and settings.
• Verify whether the Network Device or AAA client is correctly configured in
Administration > Network Resources > Network Devices
Symptoms or
Issue
Users logging into the Cisco ISE network are not experiencing the required Change
of Authorization (CoA).
Conditions Cisco ISE uses port 1700 by default for communicating RADIUS CoA requests from
supported network devices.
Possible Causes Cisco ISE network enforcement points (switches) may be missing key configuration
commands, may be assigning the wrong port (for example, a port other than 1700),
or have an incorrect or incorrectly entered key.
Resolution Ensure the following commands are present in the switch configuration file (required
on switch to activate CoA and configure the switch):
aaa server radius dynamic-author
client <Monitoring_node_IP_address> server-key <radius_key>

ISE Wired DOT1X authorization fails

I'm configuring wired dot1x, and it won't work. My end goal is to use machine/user authentication for this wired profile, but for now, because of issues I'm just attempting wired user authentication. Below is what I have
-authorization profile to allow a user based on the default (wired dot1x) and AD memberOF to get the person into the network
-the network card on the computer is setup to use "user authetication" inside of the NIC authentication tab....this is PEAP by the way.
Here is what I am seeing. I do a reboot of the machine, and the login for Windows comes up and I login. Once in Windows I look at the NIC and it says Authentication failed. ISE says that it PASSED and used my authorization profile to pass it and says that it sent my dacl. Doing a show authentication session int gi8/36 says "status authz FAILED".
I get the same thing if I use both machine and user. Machine boot->login->ISE says there was a successful authentication for the machine and sends a dacl->sh auth sess int gi8/36 says status authz failed on the switch, and the NIC shuts due to failed authentication which after that it's obviously not going to pass the user side of my policy. This is driving my nuts. If anyone could help it would be greatly appreciated. Below is config info. Thanks
Windows machines are Win7/64
switch is 6509e with 12.2(33)SXI 11 running on it.
Interface: GigabitEthernet8/36
          MAC Address: 10ee.f10c.4820
           IP Address: Unknown
            User-Name: jcarrabine
               Status: Authz Failed
               Domain: DATA
       Oper host mode: multi-auth
     Oper control dir: both
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: 0A800C010000018CF35CA5D8
      Acct Session ID: 0x0000077B
               Handle: 0x0000018C
Runnable methods list:
       Method   State
       dot1x    Authc Success
       mab      Not run
Dot1x Info for GigabitEthernet8/36
PAE                       = AUTHENTICATOR
PortControl               = AUTO
ControlDirection          = Both
HostMode                  = MULTI_AUTH
QuietPeriod               = 60
ServerTimeout             = 0
SuppTimeout               = 30
ReAuthMax                 = 2
MaxReq                    = 2
TxPeriod                  = 10
interface GigabitEthernet8/36
description TEST PORT
switchport
switchport access vlan 52
switchport mode access
switchport voice vlan 143
authentication event fail action next-method
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication timer inactivity 10
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast edge
spanning-tree bpduguard enable
end
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
ip radius source-interface Loopback0
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server host 10.128.12.41 auth-port 1812 acct-port 1813 key 7 061106324961273C464640
radius-server host 10.126.12.41 auth-port 1812 acct-port 1813 key 7 120E0C0417242221697A76
radius-server vsa send accounting
radius-server vsa send authentication

I fixed this issue So to the trained eye this should be obvious. The authz ultimatly failed not because of my authorization policies, but because I have no default permit ip any any ACL on the port. This is a requirement for the IOS I'm running. The dACL's can not be applied to the switchport without it, and thus will throw the port into an authz fail without it.

Cisco ISE User Authentication Certificates for Wired and Wirless Users (BYOD)

Can any one tell me from where we can purchase User Authentication Certificates for Wired and Wireless Users (BYOD) for Cisco ISE. Also Confirm what certificates we required for the purpose.
Please suggest the Website form where we can purchase and ipmort in Cisco ISE certificate Section.
Thanks.

Dear Mohana,
Thanks for your reply, Can you please confirm me in regards EAP-TLS certificate, which authorities you recomend if i go to Go dadday or very Sign to buy it and then import in ISE.
Looking forward for your reply.
Regards,
Muhammad Imran Shaikh
Resident Engineer, IT Network Section - PPL
Mobile : 0092-312-288-1010
LinkedIn : pk.linkedin.com/pub/muhammad-imran-shaikh/10/471/b47/

FQDN ACL on 3650/3850 with centralized webauth

Hi.
I'm trying to understand and use the fqdn acl on the IOS-XE platform. Has anyone tried this?
What Im trying to achieve is allowing android clients to download the native supplicant software from Google Play store without having a ACL with alot of IP addresses. The documentation of fqdn acl is very slim and not so much help.
Desired result: Clients are allowed to go to play.google.com and android.clients.google.com, but everything else has to be redirected to ISE.
ip access-list extended NSP
deny udp any eq bootps any
deny udp any any eq bootpc
deny udp any eq bootpc any
deny udp any any eq domain
deny tcp any any eq domain
deny icmp any any
deny ip any host A.B.C.D
permit ip any any
exit
passthru-domain-list NSP
match play.google.com
match android.clients.google.com
exit
access-session passthru-access-group NSP passthru-domain-list NSP
Host A.B.C.D is the ISE node. I've verified that the client gets the ACL, but it isnt allowed to go to play.google.com so the passthru is misconfigured or doenst work.
Im running ISE 1.3 with 3650.

Hi Ian,
It is a long post & many questions
I will try to answer as much as I can.
"I have not configured a Mobility Oracle (MO) since I only have one MC and the GA. If it is advisable to do, then would it be best to enable the MO on the MC or GA?"
No, you don't want MO unless your set-up is extremely large (it is similar to use of BGP route reflector to reduce complexity of having full mesh)
"My initial thoughts with the Mobility Agents (MA) was that it was a simple case of pointing the 3850s to the MC and the wireless service (WLAN) configurations would automatically appear. Through configuration tests and converged access deployment guides, I now believe this to no longer be the case. Therefore, for MAs to advertise wireless services they have to be individually configured. Am I correct with my thoughts?"
Yes, you have to configure your WLAN configuration in MC & MA, it won't automatically propagate to MA.
"For the deployment of WebAuth wireless services on the MA 3850 switches, I have not managed to find a guide that explains how an MA anchors wireless clients to the GA. I have found documents that describe combined MC/MA configurations to GA, but not when the 3850 is just an MA"
I have not configured this, but this is my understanding. You would configure MA WLAN pointing to GA as mobility anchor. Still traffic will transit through MC as it will manage MA & SPG (any thing outside SPG should go through MC)
Here is the some useful reference information I gathered over the timel. (white paper is the one you should read to cover everything)
https://supportforums.cisco.com/discussion/11984726/converged-access-design-information
HTH
Rasika
*** Pls rate all useful responses ****

ISE 1.2.1.198 - Guest Portal Configuration

Is it possible to customize the default portal and add a paragraph any where on the login page with instructions? I've tried adding the text in the Pre-Login Banner Text field, and it does wrap to the next line, but text goes of the screen before wrapping. Would like to be able to add carriage return in the text, so text would scroll off the screen.

ISE 1.3 (due out in November time frame) will have a huge amount of customization of the portal available for your use.
If you really need to do it before then, and you have an ISE-certified Authorized Technology Partner you're working with, they have access to a Guest Portal Builder tool that can be used.
Failing those, you're back to changing the native html code for the portal by hand. Not recommended.

Cisco ISE 1.2.1.198 Guest Portal Vlan Override at Mobile Device (android,IOS) not working

Hi Guy,
In my ISE deployment, once the guest succcesful authenticated will be assign guest VLAN for internet access.
we are using guest portal to do the vlan override once user authenticated.
Window 7 Internet explorer (Active X), Chrome (Java Aplet) is working fine.
but Android,Apple IOS devices unable to release the DHCP and get new DHCP.
because from ISE and WLC we can see the Vlan have change, how mobile devices initiate dhcp release for Guest Portal
Kindly advice.
Regards
Freemen

I don't have such documentation nor I could find any on Cisco's site. With that being said, it doesn't mean that it doesn't exist. I just know that Active X is windows specific framework and Java is not supported on either iOS nor Android:
http://www.java.com/en/download/faq/java_mobile.xml
The good news is that Cisco appears to be steering away from Java so it is possible that in the future this will be supported.
Hope this helps!
Thank you for rating helpful posts!

ISE 1.2 patch 6 - All Authentications begin failing after about 20 minutes

Hi all,
Another strange one I am throwing out to the forum. Basically I have a 5 node deployment (1 x Primary Admin, 1 x Primary Monitoring, 1 x Secondary Admin/Monitoring and 2 x Policy Nodes). The primary authentication method is EAP-TLS or PEAP for wireless only. The deployment in question has been in pilot for about 3 weeks with no issues what so ever.
As of this morning we rolled into production and all seemed well - about 100 users successfully authed against PSN1 (PSN2 is configured in the WLC as a secondary radius). About 30 minutes after the production rollout authentications began failing for the exact same reason (see attached radius log). I checked all of the certificates as recommended in the log but this was a matter of course in that everything is as it should be.
My next step was to essentially stop PSN1 (application stop ise) to see if the issue was a problem on the second PSN. All authentications were now succeeding via PSN2. I left it this way for 30 minutes with no drama. I started PSN1 again and authentications began to work....20 minutes later the issue was back. I replicated this issue again to be sure.
At this point I decided to deregister PSN1 and application reset the node before rejoining with the ISE deployment. Authentications worked well until about 30 minutes later when the issue reappeared. At this point I reloaded all nodes in the ISE deployment to see if this made a difference but the issue still remained.
Currently I have PSN1 shutdown and all is functioning well - anyone have any ideas??

I got this fixed via TAC. Basically the following is the bug but it is worth noting that this deployment was a fresh build of 1.2
https://tools.cisco.com/bugsearch/bug/CSCuj17272/?reffering_site=dumpcr
Symptom:
all auth fails when using the existing identity source sequences after upgrade from 1.1.3 to 1.2.
Conditions:
upgrade from 1.1.3 to 1.2 build 899 breaks all auth using identity sequences.
Basically the fix was to recreate my ID sequences and reapply to the authentication policy. This fixed the issue on the policy node in question.

ISE 1.1.2 patch 8 NTP Service failing

Hi all,
after a recent upgrade of my ISE deployment from 1.1.1 patch 3 to 1.1.2 patch 8, the NTP service on the ISE now crashes at regular intervals.
Can I have some help debugging this issue? I would like to check the logs but there are so many that I am not sure which one to turn debugging on.
Also, just wanted to know if anyone has seen this issue before or knows if this is a known issue when runing 1.1.2 patch 8.
Thanks everyone!
Mario

You cannot install a patch whose version is lower than the patch that is currently installed on ISE. Similarly, you cannot roll back changes of a lower version patch if a higher version is currently installed on Cisco ISE.
For NTP Configuration, you please check the below link
http://www.cisco.com/en/US/docs/security/ise/1.1/cli_ref_guide/ise_cli_app_a.html#wp2267226
http://www.cisco.com/en/US/docs/security/ise/1.1.1/upgrade_guide/upgrade.html

ISE 1.2.1.198 Wired - Central WebAuth Fail

Similar Messages

Maybe you are looking for