Wired Hotspot portal redirect fails

Question

I'm working on wired guest access from a 2960-X switch stack running 15.0(2)EX4.  The ISE 1.3 policy delivers the access-accept with the redirect URL, but the switch doesn't seem to do anything with it.  The client can do DNS resolution, so there is web traffic to redirect.  What I get is "Connecting".  The ISE can be reached directly from the client, so routing and ACL seem to be OK. It also doesn't make any difference whether the name or the IP address of the ISE policy server is used.  Anyone else seen this behavior? 
Here's the session info as seen by the switch
EF3211# sh auth sess int gi6/0/12
            Interface:  GigabitEthernet6/0/12
          MAC Address:  28d2.440e.5662
           IP Address:  Unknown
            User-Name:  28-D2-44-0E-56-62
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  single-host
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  648
     URL Redirect ACL:  Blackhole
         URL Redirect:  https://DHISE1P2.hitchcock.org:8445/portal/gateway?sessionId=82bd783e000E38FF552FED1B&portal=59c60952-e443-11e4-a2a2-0050568a6a89&action=cwa&type=drw&token=36c5ae30b39dd01e8a6b9852096a3924
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  82BDF8060004560D109E916F
      Acct Session ID:  0x00048CA9
               Handle:  0xD800088F
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
The ACL looks like this
Extended IP access list Blackhole
    10 permit udp any any eq domain
    20 permit tcp any any established
    30 permit ip any host 130.189.120.62
    40 permit ip any host 130.189.120.63
    50 permit icmp any any echo
    60 permit icmp any any echo-reply
    70 permit udp any eq bootpc any eq bootps
    80 deny ip any any

Answer 1

Problem I believe is the Redirect ACL. The ACL isn't used as access control, it's used as a filter to say which traffic is redirected. So you want HTTP and HTTPS traffic to be redirected. Should look more like the following:
deny ip any host <PSN_IP>
permit ip tcp any any eq www 443 8443
deny ip any any
So the Permit is actually saying "redirect this traffic" to ISE for CWA and the deny is saying "dont redirect". The first line is there because there used to be a bug where any traffic towards the ISE box turned into somekind of redirect loop so I've included it just to be sure.