ISE issue and re-direct to a portal

Question

I have an issue that I need help on.  This has to do with wired 802.1x NOT wireless
I have a network Windows 2008R2 Active Directory Servers and ISE version 1.1.2 patch-5.  The ISE is
integrated with Active Directory without any issues.  The supplicant is native Windows 7 Enterprise 64bits.
I've configured Windows 7 suplicant for "User or Machine authentication".  on the ISE Authentication rule, I
configure the ISE for 802.1x with ACtive Directory called CCIESEC.  On the authorization rule, I've
configured 802.1x and was machine authticated equals true.  I also have another rule that states "machine
auththenticated begins with "/host".  That will permit access.  Default rule is "deny access".
I've also set the Machine Access Restrictions (MAR) to 1 hour for testing purpose.  After one hour, the
machine must be rebooted or they will not have access to the network.  I've setup "close" mode (aka high
impact mode).  Everything is working almost as expected.
Here is what I would like to do:
1- user connects Windows 7 machine to the network.  When the CTL-ALT-DELETE appears, the machine will be
machine authenticated.  When the user type in the Active Directory password, it will be "user authenticated".
it is working now.
2- After 1 hour, the MAR expires, meaning that the machine will no longer has network access.  when the user types in the user/password, I want the browser to popup and re-direct the user to a html portal saying something like "this machine will need to be rebooted in order to have network connectivity restore".
How would go about doing this in step 2?  please help with detail steps.
Thanks in advance.

Answer 1

Please check this......
1.) Please check that the two Cisco av-pairs, configured on the  authorization profile should exactly match the example below. (Note: Do  not replace the “IP” with the actual Cisco ISE IP address.)
–  url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
– url-redirect-acl=ACL-WEBAUTH-REDIRECT (please ensure that this ACL  is also defined on the access switch)
2.)Ensure that the URL redirection portion of the ACL have been  applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address  that is passed to the client
machine by the DHCP server.)
i.e.
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A720000A45A2444BFC2&action=cpp
3.) Also make sure that the preposture assessment DACL that is  enforced from the Cisco ISE authorization profile contains the following  command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 -->for URL redirect
permit tcp any host 80.0.80.2 eq www --> to provides access to  internet
permit tcp any host 80.0.80.2 eq 8443 --> for guest portalport
permit tcp any host 80.0.80.2 eq 8905 --> for posture  communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 -->for posture communication  between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 -->for posture communication  between NAC agent and ISE (Swiss ports)
deny ip any any
4.) Please also ensure that the above URL Redirect has the proper  Cisco ISE FQDN.
As per your confirmation, I am going to close the case for this specific  inquiry. We strive to provide you with excellent service. Please feel  free to reach out to me or any member of the SAC team if we can be of  any further assistance or if you have any other related questions in the  future. We value your input and look forward to serving you moving  forward.