Sponsor Portal after upgrade ISE 1.2 - 1.3

Question

Hi,
After upgrade ISE to version 1.3 I can't access to Sponsor Portal via ://ISE_IP:8443/sponsorportal/ as it was done in version 1.2 (error: [ 404 ] Sponsor Portal Resource Not Found. The resource requested cannot be found). I have to open it through ISE (Guest Access -> Configure -> Sponsor Portals -> Sponsor Portal (Default) -> Portal test URL). But then in address bar i can see the exact same address i tried to reach (://ISE_IP:8443/sponsorportal/) but it works.
I deleted migrated portal from version 1.2 and now using only default one. Should I additionally activate it somewhere after this upgrade?

Answer 1

Nice to hear that. I just want to add something to take into account:
When you create the CSR directly from ISE, the documentation says for version 1.2 that you need minimum CN field. I did it and then I started having issues with Chrome Browser/ChromeBook which was triggering a certificate warning even though I had signed it with the correct CA Server and I had the Trusted Certificate Authority included in the browser list.
When I was using 1.1.3, I did not have that problem when using ISE internal CSR feature and only using Common Name (CN) for the CSR.
I tried using Openssl as usual to create the CSR for ISE running 1.2. Signed and imported it into the ISE and the problem was solved. I am using like you FQDN in the WLC URL Redirect on LWA or CWA with the corresponding entry into the DNS. One important thing I found is that openssl uses some additional fields which I included in the CSR and I think after reviewing the ISE 1.2 documentation we need to include those as well in the ISE CSR feature. Looks like also there is a sequence/order for those fields in the ISE when creating the ISE CSR. The list is the following:
countryName       = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName  = optional
organizationalUnitName  = optional
commonName        = supplied
emailAddress            = optional
Finally, with Openssl I could create as well SAN Certificates and I included the IP of the PSN , PAN and MNT ISE's so I would not need the DNS Entry. This feature was added on version 1.2 of the ISE which helps a lot. I will give it a few more testing since that I have a lab deployment with 5 ISE's (PAN, MNT and 3 PSN's).