ISE HTTP GUEST PORTAL

Hello,
We have some disconfort with Guest web authentication. When WLC redirects a guest user, he views certificate error.
Can I use http instead https for guest portal?
Thanks,
Oleg

Hi,
Is your guest portal on the ISE ? In the ISE , there is only HTTPS port allowed to configure under Guest portal and no option of http port is there , So I dont think so. You also might be using port 8443 in the external web-auth redirection URL under security tab.
Now even if you put a valid certificate on the ISE which hosts external guest portal , still you would receive certificate warning as long as you use local web server of the controller which is its virtual ip address.This is because even if the external web server where page is hosted for example has a valid certificate , even then internal virtual ip address is presented to the client.
So
> either you trust them in your browser so that you dont receive certificate warnings
>or else have a valid certificate on the controller and external web server.
> or use http for web authentication in the controller and also http to external hosted page, then also you can get rid of these certificates.
Regards
Dhiresh

Similar Messages

ISE and Guest Portal

WLC - 7.2.110.0
ISE - 1.1.1
I'm new to ISE. I want to set up a very basic method for BYOD users to access our wireless network. I've set up an SSID for external Web Auth, where users get redirected to the ISE Guest Portal: https://1.2.3.4:8443/guestportal/Login.action
At that screen, users can enter their Active Directory credentials and login. Although the authentcation shows as successful under Operations -> Authentications, the user is redirected to the device registration page. On that page they see the message "We are unable to determine access privileges in order to access the network. Please contact your administrator." Their device MAC is listed, and they can enter a description but the "Register" button is greyed out.
I'm getting overwhelmed with the amount of documentation available as well as the new terminology. I'm familiar with using Windows RADIUS servers, but ISE is very foreign to me now. Is there any documentation to help me understand how access requests are processed?

As you asked the documents related to ISE and Guest Portal. I am sending you two docs which will help you in this case. Please find the below documents:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html
http://www.cisco.com/en/US/docs/security/ise/1.0.4/user_guide/ise10_guest_pol.pdf

ISE Wired guest portal redirect even after authentication

Hi
I have configured both Wired and Wireless guest authentication via guest portal. Wireless is working fine, however the when trying with Wired, the redireciton page is keep getting even after user authenticated.
I'm not seen the redirection authorization policy in my logs however I can see only the user authentication logs (successful). Attached is my configuration and logging output.
Here is what I see on the interface
ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
            Interface: GigabitEthernet4/0/19
          MAC Address: a0b3.ccca.2ab1
           IP Address: 10.1.3.16
            User-Name: A0-B3-CC-CA-2A-B1
               Status: Authz Success
               Domain: DATA
       Oper host mode: multi-auth
     Oper control dir: both
        Authorized By: Authentication Server
          Vlan Policy: N/A
     URL Redirect ACL: ACL-WEBAUTH-REDIRECT
         URL Redirect: https://xxxx-TW-ISE-2.xxx.xxx.qa:8443/guestportal/gateway?sessionId=AC14011F000001571E52779F&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: AC14011F000001571E52779F
      Acct Session ID: 0x00000309
               Handle: 0xE6000158
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
Here is the ACL
Extended IP access list ACL-WEBAUTH-REDIRECT
    10 deny udp any any eq domain (1344 matches)
    20 deny ip any host 172.20.5.12 (8122 matches)
    30 deny ip any host 172.20.5.14
    40 permit tcp any any eq www (3124 matches)
    50 permit tcp any any eq 443 (202927 matches)
    60 permit tcp any any eq 8080 (114 matches)
    70 permit ip any any (8056 matches)

Hi Mohannad,
Thanks for your response.
Actually the as per the configuration it should work, I'm still trying to find out what is what has gone wrong with this configuration. Infact I have tested with 3560 switch with the same config and it worked. only difference here is we used 2960S switch.
We need to find out why the next Auth policy is not hitting once user is authenticated.
Here is the port configuration and the authen status of the port.
ABQT-3FLR-ACC-01#sh running-config interface gig4/0/19
Building configuration...
Current configuration : 427 bytes
interface GigabitEthernet4/0/19
switchport access vlan 103
switchport mode access
switchport voice vlan 135
authentication event fail action next-method
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab webauth
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
end
ABQT-3FLR-ACC-01#
Mar 31 12:32:14.127: %AAA-3-BADSERVERTYPEERROR: Cannot process accounting server type tacacs+ (UNKNOWN)
ABQT-3FLR-ACC-01#
ABQT-3FLR-ACC-01#sh atuh
ABQT-3FLR-ACC-01#sh atu
ABQT-3FLR-ACC-01#sh authe
ABQT-3FLR-ACC-01#sh authentication se
ABQT-3FLR-ACC-01#sh authentication sessions in
ABQT-3FLR-ACC-01#sh authentication sessions interface gi
ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
            Interface: GigabitEthernet4/0/19
          MAC Address: 0015.c5b4.fd4a
           IP Address: 10.1.3.23
            User-Name: 00-15-C5-B4-FD-4A
               Status: Authz Success
               Domain: DATA
       Oper host mode: multi-auth
     Oper control dir: both
        Authorized By: Authentication Server
          Vlan Policy: N/A
     URL Redirect ACL: ACL-WEBAUTH-REDIRECT
         URL Redirect: https://ABQ-TW-ISE-2.abq.gov.qa:8443/guestportal/gateway?sessionId=AC14011F0000018A32B4D906&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: AC14011F0000018A32B4D906
      Acct Session ID: 0x00000394
               Handle: 0x3E00018B
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success

ISE 3315 Guest Portal on ETH1?

Hi,
the 3315 and other ise appliances have multiple nics.
Is it possible/supported to use eth1 for hosting the guest portal? (wireless LWA)
Tnx,
Bart

jrabinow ,
I found this reference:
http://www.cisco.com/en/US/docs/security/ise/1.1/installation_guide/ise_app_e-ports.html
it states that the guest portal services are also listening on the other interfaces..
Could somebody please confirm?

HTTPS Guest Portal Redirection

Dears,
We have Guest Portal on ISE server, when our guests connect to Guest SSID they automatically redirected to WEB portal
it works only with http websites
if user writes in his browser for example facebook.com or some websites with https redirection doesnt happens
thank you

It's new:) the first version of 8.0.100.0 wasn't great if you ask me. v8.0.110.0 is MR1 and fixes some issues but it's new. I would wait for MR2/3 before going into production unless you really need to go to v8.0. You can always downgrade. You need to make sure your AP's support this code and if you have WCS/NCS/PI and or MSE. Here is the compatibility matrix:
http://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html
-Scott

ISE - sponsor guest portal with smartcard authentication

Team, any support for sponsor guest portal authentication with the smartcard?
If not then can someone plese create feature request to Cisco, smartcards are being rolled out more and more.
Bilal

We've got it working in our agency. It's front ended by an 5540 ASA that sends the users attributes to ISE and then loops ISE to authenticate via AD. I've got a pretty sweet write up on it from our advanced services rep. The guys are legit when it comes to work around and I just finished testing this with ISE 1.3. If you guys are interested I'll attach it tomorrow.
Attached configuration guide. Note for 1.3 the Sponsor Group Policy has been removed. Just make sure the Sponsor Group is configured and add the store to locate the user. In our case its AD.
If you have questions just PM me and Ill be glad to assist.
-Ryan

ISE 1.1 - Error Custom Guest Portal

Ciao,
we are facing a strange problem on ISE Custom Guest Portal.
After pressing the login button it returns an error:
Error:
Resource not found.
Resource:/guestportal/
It seems like that te function "/guestportal/LoginCheck.action" is not able to return the succesfull login page.
It's quite strange because user are authenticating without problem.
Any clue?
Ciao e grazie!
Luciano

Ciao,
we faced the problem on clients connected in wireless, where WLC redirect to the custom guest portal.
The setup works fine for almost 2 months, than it stop working; then we re-imaged the device (1st time).
Digging in the log with SE of TAC (621986639) we found these errors:
2012-06-06 13:55:32,152 ERROR 2012-06-06 13:55:32,152 [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
2012-06-06 13:57:43,839 ERROR 2012-06-06 13:57:43,839 [http-443-10][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:8080/guestportal/gateway?sessionId=SessionIdValue&action=cpp
2012-06-06 13:59:39,923 ERROR 2012-06-06 13:59:39,923 [http-443-5][] api.services.persistance.dao.ResourceDAO- Exception while retrieving the resource //ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa
And during the test these errors were generated:
2012-06-07 16:05:58,448 ERROR 2012-06-07 16:05:58,448 [http-8080-2][] org.apache.struts2.dispatcher.Dispatcher- Could not find action or result
There is no Action mapped for action name Login. - [unknown location]
         at com.opensymphony.xwork2.DefaultActionProxy.prepare(DefaultActionProxy.java:186)
         at org.apache.struts2.impl.StrutsActionProxyFactory.createActionProxy(StrutsActionProxyFactory.java:41)
         at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:494)
         at org.apache.struts2.dispatcher.FilterDispatcher.doFilter(FilterDispatcher.java:422)
So we performed another re-image (2nd time) with a different media (not sure the problem was the media, it should be some script fail) today I'm performing some test ... I'll update this discussion asap.
Ciao!
Luciano

ISE Guest Portal only redirect HTTPS traffic.

I have a wireless deployment consisting of the following:
5760 WLC & ISE 1.2
Am I missing something here
I have 4 similar deployments, and never had these issues:
On Android / Apple devices, the guest portal does not pop up automatically &
On a Windows Laptop only https traffic directs to the guest portal.
Thanx

i think you need to recheck the configuration also check the link for step by step config
http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-security/landing_DesignZone_TrustSec.html

5760 v3.6 guest portal redirect to ISE

I'm testing a new set of 5760 controllers for a future production rollout, running software version 3.6. Our current production setup consists of older WISM-1 and 4402 controllers running CUWN 7.0. Our guest network has an anchor in the DMZ, redirecting to ISE.
In the recent thread (https://supportforums.cisco.com/discussion/12319151/3850-ise-guestportal-no-redirect-v-334), one of the posters said that guest redirection in 3.6 works similarly to redirection in CUWN, while in 3.3 it is very different. I found the documentation for 3.3 (http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html), which I have to say I don't like very much. However, I find the configuration and command reference guides for 3.6 are less than helpful on this point.
So the question I have is whether guest networking with an external redirect to ISE looks like the following in 3.6? Or does it work like CUWN, where the SSID is configured with layer 3 security? If it uses layer 3 security like CUWN, does anybody have a quick configuration sample for how it can work end to end in 3.6?
------ From the document http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html ---------
The flow includes these steps:
The user associates to the web authentication Service Set Identifier (SSID), which is in fact open+macfiltering and no Layer 3 security.
The user opens the browser.
The WLC redirects to the guest portal.
The user authenticates on the portal.
The ISE sends a RADIUS Change of Authorization (CoA - UDP Port 1700) in order to indicate to the controller that the user is valid, and eventually pushes RADIUS attributes such as the Access Control List (ACL).
The user is prompted to retry the original URL.

I have a project with a 5760 running 3.6 working to a 5508 anchor controller in a DMZ.
I have web authentication working to an ISE OK.
Regards
Roger

Ise 1.2, cannot access guest portal

I upgraded from 1.1.4 patch 3 to 1.2 but cannot access guest portal anymore nor with FQDN:8443 nor with IP:8443
any idea?

I had attached the steps to configure the guest portal and hope will address the problem.
Configuring the Guest Portal
Adding a New Guest Portal You must configure settings for the Guest portal before allowing guests to use it to access the network. Some settings apply globally to all Guest portals and other require you to set them for each portal individually.
You can add a new Guest portal or edit an existing one.
Step 1Choose Administration > Web Portal Management > Settings > Guest > Multi-Portal Configurations.
Step 2Click Add.
Step 3Update the fields on each of these tabs:
•General—enter a portal name and description and choose a portal type.
•Operations—enable the customizations for the specific portal
•Customization—choose a language template for displaying the Guest portal with localized content
•File Uploads—displays only if you have chosen a portal type requiring you to upload custom HTML files.
•File Mapping— identify and choose the HTML files uploaded for the particular guest pages. Displays only if you have chosen a portal type requiring you to upload custom HTML files.
•Authentication—indicate how users should be authenticated during guest login.
Step 4Click Submit.
Specifying Ports and Ethernet Interfaces for End-User Portals
You can specify the port used for each web portal allowing you to use different ports for the end-user portals: Sponsor, Guest (and Client Provisioning), My Devices, and Blacklist portals. The Client Provisioning portal uses ports 8905 and 8909 for posture assessments and remediation, which you cannot change. Otherwise, it uses the same ports assigned to the Guest portal.
You can also partition portal traffic to specific Gigabit Ethernet interfaces. For example, you might not want the Admin portal (which always uses GigabitEthernet 0) available on the same network as guest users or employee devices.
Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
Step 2Enter the port value in the HTTPS Port field for each portal. By default, the Sponsor, Guest, My Devices portals use 8443, and the Blacklist portal uses port 8444.
Step 3Check the Gigabit Ethernet interfaces you want to enable for each portal.
Step 4Click Save.
If you have changed the port settings, all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
Tips for Assigning Ports and Ethernet Interfaces
•All port assignments must be between 8000-8999. This port range restriction is new in Cisco ISE 1.2. If you upgraded with port values outside this range, they are honored until you make any change to this page. If you make any change to this page, you must update the port setting to comply with this restriction.
•You must assign the Blacklist portal to use a different port than the other end-user portals.
•Any portals assigned to the same HTTPS port also use the same Ethernet interfaces. For example, if you assign both the Sponsor and My Devices portals to port 8443, and you disable GigabitEthernet 0 on the Sponsor portal, that interface is also automatically disabled for the My Devices portal.
•You must configure the Ethernet interfaces using IP addresses on different subnets. Refer to these guidelines to help you decide how best to assign ports and Ethernet interfaces to the end-user portals:
Specifying the Fully Qualified Domain Name for Sponsor and My Devices Portals
You can set the Sponsor and My Devices portals to use an easy-to-remember fully-qualified domain names (FQDN), such as: mydevices.companyname.com or sponsor.companyname.com. Alternatively, Cisco ISE also supports wildcard certificates to address certificate name mismatch issues. You must configure DNS to resolve to at least one policy services node. If you have more than one policy services node that will provide portal services, you should configure high availability for the portal. For example, you could use a load balancer or DNS round-robin services.
Before You Begin
Step 1Choose Administration > Web Portal Management > Settings > General > Ports.
Step 2Scroll to the Portal FQDNs section, and check the appropriate setting:
•Default Sponsor Portal FQDN
•Default My Devices Portal FQDN
Step 3Enter a fully qualified domain name.
Step 4Click Save, and all nodes (Administration, Policy Services, and Monitoring) restart automatically, which may take several hours to complete.
Step 5Configure the network DNS server so that it resolves the FQDN to the Sponsor or My Devices portal nodes. You must also update DNS to ensure the FQDN of the new URL resolves to a valid policy service node IP address. Additionally, to avoid certificate warning messages due to name mismatches, you should also include the FQDN of the customized URL in the subject alternative name (SAN) attribute of the local server certificate of the Cisco ISE policy service node.

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

Cisco ISE 1.2 Guest Portal customization with vWLC redirect

Hello Support Community,
we have a problem regarding customized web authentication on ISE 1.2 with Package ISE12CustomPortalPackage-v4.zip. We have a Virtual Wireless Controller where we do a redirect to ISE. When we use default guest portal on https://x.x.x.x:8443/guestportal/Login.action authentication and authorization works fine. When we do redirect to Cisco templates on https://x.x.x.x:8443/guestportal/portals/example/Login.html customized login page is displayed and after correct authentication guest successful page is displayed but we can't go to any webserver although ISE shows authentication and authorization as successful. When we try to reach a webserver after successful authentication we get redirected to customized login site. Virtual Wireless Controller shows client aus "Webauth Required" after successful authentication. Central Web Authentication isn't possible because we have a different AAA Server for 802.1X and only use wired guest access on a particular VLAN from WLC. Are there any known issues regarding customization template or is there something wrong regarding our redirect?
I hope somebody can help us.
Best Regards
Benjamin

Hello Neno,
1. I attached screenshots below.
2. There is nothing related to this client.
3. I attached Debug below.
We are currently using MAB on our switches as a fallback to our 802.1X on our wired access. Order and Priority currently is 802.1X/MAB/Auth-Fail-VLAN. CWA is based on a failed MAC-Authentication which leads to an Authorization Profile to permit access with Webauth.
If you configure Wired guest access on WLC there isn't a possibility to configure MAC-Authentication.
CWA on our switches isn't possible because we are currently using failed MAC-Authentication to direct clients to our Auth-Fail-VLAN which has restricted access secured by SVI-ACL which allows us HTTP Access to printers (manual Cert Deployment) and automated Cert enrollment to our computers.
Best Regards
Benjamin

Cisco ISE - cannot reach Guest Portal

Hi all,
I have a Cisco ISE server, which is installed on a VMWare plattform. On the ISE server, I configured 2 network cards. One for the Corporate network ( Gigabit Ethernet 0) and one for the Guests (Gigabit Ethernet 1). Because I had problems, I put a client into the Guest VLAN (Wired) and tried to access the guest portal which was not working.
I recognized that the port 8443 for the guest portal is blocked. But I was able to ping the address, and the port 443 and 22 are open as well. On the Gigabit Ethernet 0 network everything works.
All interfaces are activated at the Web Portal Management Settings, for the ports 8443 and 8444.
Anybody an idea??
T&R
Frank

Please use the below ISE- guest URL redirection tshoot doc. below
http://www.cisco.com/en/US/docs/security/ise/1.2/troubleshooting_guide/ise_tsg.html

Cisco ISE 1.2.1.198 Guest Portal Vlan Override at Mobile Device (android,IOS) not working

Hi Guy,
In my ISE deployment, once the guest succcesful authenticated will be assign guest VLAN for internet access.
we are using guest portal to do the vlan override once user authenticated.
Window 7 Internet explorer (Active X), Chrome (Java Aplet) is working fine.
but Android,Apple IOS devices unable to release the DHCP and get new DHCP.
because from ISE and WLC we can see the Vlan have change, how mobile devices initiate dhcp release for Guest Portal
Kindly advice.
Regards
Freemen

I don't have such documentation nor I could find any on Cisco's site. With that being said, it doesn't mean that it doesn't exist. I just know that Active X is windows specific framework and Java is not supported on either iOS nor Android:
http://www.java.com/en/download/faq/java_mobile.xml
The good news is that Cisco appears to be steering away from Java so it is possible that in the future this will be supported.
Hope this helps!
Thank you for rating helpful posts!

Pb to reach ISE Guest portal due to DNS constraints

I have set up a Guest Portal with WLC 5508 7.4 and ISE 1.1.1 ;
everything is OK, except one thing :
the Guest VLAN, associated to the Guest SSID is, actually, a DMZ behind my customer firewall and the DHCP parameters provided to the wireless Guest equipement connected on this VLAN include the public ISP DNS servers addresses, not the customer internal DNS serveurs addresses;
this seems OK since the idea of this Guest SSID is to give a pure Internet access to the Guests, and no connection at all towards the customer internal servers;
the problem is that, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this internal DNS name by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
Apart from changing those DNS values in the DHCP server (the customer does not accept this solution), how could we solve this problem ?
I have tried to code manually , in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://192.168.1.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa,
but, it does not work, since the sessionIdValue variable is not replaced by its real value when sent to the wireless client
any comment welcomed

We had the same issue. Our solution was to advertise the internal IP address from our external facing DNS server and let it propagate publicly. Our ISE box is in a DMZ and the firewall rules do not allow outside traffic to it, however the clients will get the correct internal IP address and since they are already inside the firewall on the DMZ segment they are able to get to the ISE box with the publicly resolved internal IP address. The other option we entertained was a firewall DNS redirect. That would work by intercepting the DNS request for that specific URL and return the proper internal IP, all other DNS requests would pass through to the public DNS server.

ISE HTTP GUEST PORTAL

Similar Messages

Maybe you are looking for