ISE Guest webauth error

Using central web auth 802.1x on a 3560 to ISE. I get to the web portal fine and was able to login with the guest account and change the password. Now when I get redirected to the portal everytime I login I get "Your session has expired. Please login again". The error in ISE is show up as Guest authentication failed: 86017: Session cache entry missing.
From the ISE log
Other Attributes:
ConfigVersionId=56,PortalName=DefaultGuestPortal,CPMSessionID=0A0A084E0000001B4CCB2B1B
From the switch show authentication sessions
ISE-test#sh authentication sessions int fa0/1
            Interface: FastEthernet0/1
          MAC Address: 5c26.0a38.a800
           IP Address: 172.31.255.15
            User-Name: 5C-26-0A-38-A8-00
               Status: Authz Success
               Domain: DATA
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: multi-domain
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
     URL Redirect ACL: ACL-WEBAUTH-REDIRECT
         URL Redirect: https://oranetise01.naismc.com:8443/guestportal/gateway?sessionId=0A0A084E0000001B4CCB2B1B&action=cwa
      Session timeout: 3600s (local), Remaining: 1324s
       Timeout action: Reauthenticate
         Idle timeout: 900s (local), Remaining: 418s
    Common Session ID: 0A0A084E0000001B4CCB2B1B
      Acct Session ID: 0x000001C8
               Handle: 0xC400001C
Runnable methods list:
       Method   State
       mab      Authc Success
       dot1x    Not run
            Interface: FastEthernet0/1
          MAC Address: 0004.f21c.66a9
           IP Address: 10.20.0.177
            User-Name: 00-04-F2-1C-66-A9
               Status: Authz Success
               Domain: VOICE
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: multi-domain
     Oper control dir: both
        Authorized By: Authentication Server
              ACS ACL: xACSACLx-IP-PERMIT_ALL_TRAFFIC-4f57e406
      Session timeout: 3600s (local), Remaining: 1253s
       Timeout action: Reauthenticate
         Idle timeout: N/A
    Common Session ID: 0A0A084E000000161ED6CBD9
      Acct Session ID: 0x000000F2
               Handle: 0x19000017
Runnable methods list:
       Method   State
       mab      Authc Success
       dot1x    Not run
The session ID from the browser of the PC seems to match the above session IDs. I'm at a loss.

And now it works and I didn't change anything. How is the session ID generated and for how long does it last? Maybe it finally timed out and generated a new one. The PC stayed connected to the port the entire time and was not rebooted either.
From ISE
Other Attributes:
ConfigVersionId=56,EndPointMACAddress=5C-26-0A-38-A8-00,PortalName=DefaultGuestPortal,CPMSessionID=0A0A084E0000001B4CCB2B1B
sh authentication sessions int fa0/1
            Interface: FastEthernet0/1
          MAC Address: 5c26.0a38.a800
           IP Address: 172.31.255.15
            User-Name:
               Status: Authz Success
               Domain: DATA
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: multi-domain
     Oper control dir: both
        Authorized By: Authentication Server
          Vlan Policy: 46
              ACS ACL: xACSACLx-IP-PERMIT_ALL_TRAFFIC-4f57e406
      Session timeout: 3600s (local), Remaining: 3357s
       Timeout action: Reauthenticate
         Idle timeout: 900s (local), Remaining: 657s
    Common Session ID: 0A0A084E0000001B4CCB2B1B
      Acct Session ID: 0x000001C8
               Handle: 0xC400001C
Runnable methods list:
       Method   State
       mab      Authc Success
       dot1x    Not run
            Interface: FastEthernet0/1
          MAC Address: 0004.f21c.66a9
           IP Address: 10.20.0.177
            User-Name: 00-04-F2-1C-66-A9
               Status: Authz Success
               Domain: VOICE
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: multi-domain
     Oper control dir: both
        Authorized By: Authentication Server
              ACS ACL: xACSACLx-IP-PERMIT_ALL_TRAFFIC-4f57e406
      Session timeout: 3600s (local), Remaining: 1644s
       Timeout action: Reauthenticate
         Idle timeout: N/A
    Common Session ID: 0A0A084E000000161ED6CBD9
      Acct Session ID: 0x000000F2
               Handle: 0x19000017
Runnable methods list:
       Method   State
       mab      Authc Success
       dot1x    Not run

Similar Messages

ISE Guest Portal - Error Resource not found

Hello,
When I create a guest user through the sponsor portal, then try to login with this guest user through the Guest Portal, after I press login button, the following error message occurs and do not know what to do to solve.
Error: Resource not found.
Resource: /guestportal/
None of the messages on the forum about it helped me to solve the problem.
I am using ISE 1.1.3.124 and this is a new re-image appliance.
Can anyone help?

Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again.

ISE Guest portal CWA - Webauth exit button on Login Successful page not working (Safari and Chrome)

Hello
Has anyone else experienced the issue where this exit button works when IE is used to login to the ISE Guest portal, but not when Chrome is used. Same for Safari (from IPAD).
Sent from Cisco Technical Support iPad App

Google Chrome is not a fully supported browser for use with the Administrative User Interface of the Identity Services Engine (ISE), Version 1.1.3 and earlier.

How to use ISE Guest Portal for AD users

Hi there,
As subject explains all, I want to use ISE Guest Portal for my domain users. I have tried many different ways to authenticate users and finally I came to the conclusion that ISE CWA works pretty well and is very stable. WLC Webauth sucks alot, does not redirect to the login page always.
Can you please share what other ways are stable ways to authenticate AD users? I know about WPA 802.1x authentication but that requires a CA in the network which is not available at the moment. So can you please Suggect?
Otherwise, I want to use ISE Guest Portal for my AD users as well. AD is already integrated to ISE, the issue happens when I attempt to athenticate using AD user account, the user gets authenticated but the Guest Portal redirects me to Device Provissioning page and there it shows an error saying "there is not policy to register the device, contact system admin"
Am I missing something??
I am running WLC 5760 with ISE 1.2
Thanks in advance..

Hi,
Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
Thanks,
Tarik Admani
*Please rate helpful posts*

Guest Anchor with web auth using ISE guest portal

Hello All,
Before launching into my exact issues, could anyone confirm if they have completed a wireless Guest anchor setup using 2504 controllers on 7.4 as the anchor (5508 is the foreign) with webauth external redirection at ISE 1.1.3 using ISE Guest Services?
I am attempting this for an internal POC and have hit a couple of issues. Firstly I am looking for correct configuration confirmation prior to going in depth with a couple of the issues. I've been using the TrustSec 2.1 how to guides to build the parts I am not strong on so if anyone has actual completed this setup, I'd love to go through it with you.
massive thanks to anyone that can assist.
JS.

Thanks for the reply RikJonAtk.
so to start with, based on the trust sec documents, of the guest WLAN on the anchor I need to configure mac filtering at the layer 2 security menu as well as enable RADIUS NAC under the Advanced tab. But when I do this, I get an error message that states that mac filitering and RADIUS NAC cannot be enable at the same time.
Additionally, if I just enable the RADIUS NAC setting under the Advanced tab in the WLAN, I get another error message that states that the priority order for Web-Auth can only be set for radius, so I go to the AAA server tab and send local and LDAP to the not use column and hit apply. If I move to another menu then check the priority order again under the AAA servers tab, the local and LDAP have been moved back to the menu field to be used again. So I initially though it might be a bug, but I was hoping to find someone here that has done this already and can look at my issues and maybe walk me through their configs, which I'll mirror and see how it goes.
Thanks in Advanced,
JS

ISE CWA WebAuth with WLC

Hi all,
I have a few questions regarding WebAuth or Guest access with ISE. I have setup a guest portal to do CWA and use ISE guest portal
as the redirect page.
I'm using ISE 1.1.2 and WLC version 7.3.101
1- I have an issue authenticating with Chrome on W7 and android. I receive the splash page, i can authenticate but i always receive this error message. With IE and firefox i can accept and add an exception and authenticate successfully.

Hi,
Your best bet is to run true CWA and not use the redirect feature on the controller. Just allow dns and access to port 8443 in the ACL that is referenced by ISE when it sends the CWA redirect. You can use mac filtering as your L2 authentication.
This will help in your redundant scenario so that when one ise goes down the second ise can send the CWA over to it.
As far as certs if you are using mobile devices you may want to consider 3rd party certs.
Let me know if that helps.
Tarik Admani
*Please rate helpful posts*

Cisco ISE Guest Login

Hi,
I have a weird problem; after a guest user account has been created on Cisco ise 1.1.4 patch 8; when the guest user is redirected to the ise guest portal; the first login is always unsuccessful. Upon entering the login credential and password correctly; the client would be redirected to the same login page. Upon retrying the process a few times; it would succeed after 2-3 times.
On the ise authentication; I see a guest authentication error; "Guest Authentication Failed : 86020: Unknown exception" with only a single step seen on the logs for troubleshooting "5431 Guest Authentication Failed"
I would like to check if anyone has seen such an issue/behaviour?
Any suggestions is appreciated.
Thanks.

No it doesn't, you can test the same , while editing the wireless SSID profile, opting authentication method as smart card other than PEAP/EAP.

Is it possible to make the ISE guest server redundant ?

Hi,
We've an ISE cluster of two ISE nodes.
The ISE guest server works fine on the primairy ISE node.
MAC address of the guest client is set in the map 'GuestDevices' after accepting the AUP policy.
The the ISE sents the COA and the client authenticates again and is punt in the guest vlan.
But when the primairy ISE is offline, I see the guest portal AUP page on the secondairy ISE node.
I can accept the AUP policy, and I get an error message.
On the secondairy ISE I see that the COA to the switch is sent, to clear the session to the primairy ISE....
But the COA request should ask to clear the session to the secondairy ISE ( the primairy ISE is offline ).
Should it be possible to configure the ISE guest functionality redundant in an ISE cluster?
/SB

The Guest portal can run on a node that assumes the Policy Services persona when the primary node with Administration persona is offline. However, it has the following restrictions:
•Self registration is not allowed
•Device Registration is not allowed
•The AUP is shown at every login even if first login is selected
•Change Password is not allowed and accounts are given access with the old password.
•Maximum Failed Login is not be enforced
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html#wp1126706

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

ISE Central webauth and vWLC 7.4

Hi Everybody,
I am wondering if anyone has gotten this scenario to work, Cisco ISE Guest Portal via CWA redirect on an AP connected to a Virtual WLC running 7.4. As vWLC can only run flexconnect, and no centrally switched vlans are supported, how would this scenario be possible, if at all, the AP would have to do the redirect instead of the controller ?

Yes, I agree with Tarik
also do review the below link which might be helpful:
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_41_guest_services.pdf
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_40_webauthentication_dg.pdf

Pb to reach ISE Guest portal due to DNS constraints

I have set up a Guest Portal with WLC 5508 7.4 and ISE 1.1.1 ;
everything is OK, except one thing :
the Guest VLAN, associated to the Guest SSID is, actually, a DMZ behind my customer firewall and the DHCP parameters provided to the wireless Guest equipement connected on this VLAN include the public ISP DNS servers addresses, not the customer internal DNS serveurs addresses;
this seems OK since the idea of this Guest SSID is to give a pure Internet access to the Guests, and no connection at all towards the customer internal servers;
the problem is that, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this internal DNS name by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
Apart from changing those DNS values in the DHCP server (the customer does not accept this solution), how could we solve this problem ?
I have tried to code manually , in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://192.168.1.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa,
but, it does not work, since the sessionIdValue variable is not replaced by its real value when sent to the wireless client
any comment welcomed

We had the same issue. Our solution was to advertise the internal IP address from our external facing DNS server and let it propagate publicly. Our ISE box is in a DMZ and the firewall rules do not allow outside traffic to it, however the clients will get the correct internal IP address and since they are already inside the firewall on the DMZ segment they are able to get to the ISE box with the publicly resolved internal IP address. The other option we entertained was a firewall DNS redirect. That would work by intercepting the DNS request for that specific URL and return the proper internal IP, all other DNS requests would pass through to the public DNS server.

ISE Guest Access- Redirect to URL after successful logon

Currently, when guest users attempt to browse they get redirected to the guest portal. After login, they get a message that they can now access the original URL. Is there a way to automatically redirect to the URL they were trying to access, or remember the URL after they login?

ISE guest flow :
The user associates to the web authentication Service Set Identifier (SSID).
The user opens the browser.
The WLC redirects to the guest portal (such as ISE or NGS) as soon as a URL is entered.
The user authenticates on the portal.
The guest portal redirects back to the WLC with the credentials entered.
The WLC authenticates the guest user via RADIUS.
The WLC redirects back to the original URL

ISE Guest Port Direction not working

Hi Guys,
Got a problem here with ISE guest authentication.
My configuration in the WLC is as bellows:
And the configuration in my ISE is as bellows:
After my device connects to the SSID, I cannot be redirected to the guest portal, no redirection URL showed up in my browser, while the URL is pushed to the WLC client as bellows:
DNS A record has been added before and I can open the FQDN.
Can anyone help me about this? Thanks!
Best Regards,
Savi

Are you able to ping / nslookup to ISE.wuscnad.com from the test client?
Also, please provide a screen shot of the set of ACL's CWA-Guest from the WLC?
Here is a document you can go through to configure wireless CWA
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
Regards,
Jatin

Using ISE guest store via RADIUS

I have a question concerning the guest store on the ISE.
I would like to establish a guest portal on a WLC (currently running version 7.0.220.0). The guest network shouldn’t have any connection to the company network. So I can’t redirect to the ISE guest portal and have to use the local portal on the WLC and pass the login data to the ISE via RADIUS. Nevertheless I want to use the guest store on the ISE.
On the ISE I can only select the internal user store as identity source. But this seems not to include the guest user store.
Has anyone already implemented a similar solution or any idea how to access the guest store?
Thanks
Thomas

I just created a simple setup and tested the login.
It doesn't work with a user created as a guest account.
If I create the user in the normal internal identity store I works fine.
Might there be a difference between ISE Versions?
We are currently using Version 1.1.0.665 on a VM for testing purpose.
This is what the details show:
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24206 User disabled
22057 The advanced option that is configured for a failed authentication request is used
22061 The 'Reject' advanced option is configured in case of a failed authentication request
11003 Returned RADIUS Access-Reject
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24212 Found User in Internal Users IDStore
22037 Authentication Passed
Evaluating Authorization Policy
15004 Matched rule
15016 Selected Authorization Profile - Guest
11022 Added the dACL specified in the Authorization Profile
11002 Returned RADIUS Access-Accept

ISE Guest - Change Password Option

Hi All
Can anyone confirm that the change password option on the Guest Self Registration Portal actually works?
I have enabled the options with the ISE Guest Portal to allow the Guest to create his own account and also to change his password.
Although the self creation of the account works fine it doesn't look like changing the password works. When you enter the new password and click submit nothing seems to happen.
ISE version is 1.2.1.198
Regards
Roger

Hi Roger,
Are you making use of customized self registration portal. In such cases make sure , the session ID of a particular guest login is carried forward to the password change page as well.
For the html changes to any pages (login, aup, self_registration, self_registration_result,
device_registration & change_password) that link back to other pages. The below points A and B should be added as part of customized pages.
A)Reference script (<script src="js/customportals.js"></script>)
B)Add the onsubmit="getDynamicAction(this);" logic for posts
Thanks

ISE Guest webauth error

Similar Messages

Maybe you are looking for