Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CWA NOT REDIRECT AUTOMATIC IN CLIENT WEBBROWSER

 

Guys, i have problem, the the portal cwa not open automatic in clients, if the client copy and paste the url of session, this open!! but automatic is the problem, the acl is ok, dns is ok.

 

switch version 15.2

 

 

 

5 REPLIES
Cisco Employee

Client Machine URL

Client Machine URL Redirection Function Not Working

 

 

 
 

Symptoms or Issue

 

Users are not appropriately redirected to the correct URL for authentication.

Conditions

 

The monitoring and troubleshooting configuration validator is designed to catch this. The web authentication configuration (global) details may display something like the following:

Mandatory Expected Configuration Found On Device

aaa authorization auth-proxy default group <radius_group> aaa authorization auth-proxy default group radius

aaa accounting auth-proxy default start-stop group <radius_group> Missing

ip admission name <word> proxy http inactivity-time 60 Missing fallback profile <word>

ip access-group <word> in

ip admission <word> Missing

ip http server ip http server

ip http secure-server ip http secure-server

 

Possible Causes

 

The switch is missing the ip http server and/or ip http secure-server command.

 

Resolution

 

Verify and (if necessary) adjust the configuration on the switch.

 

 

and also verify the similar issue with solution:

https://supportforums.cisco.com/discussion/11954461/cwa-page-does-not-redirect

New Member

NOT WORK!!  

NOT WORK!!

 

 

Cisco Employee

Can you post your switch

Can you post:

1. Your switch configuration 

2. The output of show authentication session interface interface_name_number where the client is connecting

 

Thank you for rating helpful posts!
New Member

SW-ISE#show authentication

SW-ISE#show authentication sessions interface fastEthernet 0/1
            Interface:  FastEthernet0/1
          MAC Address:  6431.5077.5aa2
           IP Address:  172.16.1.2
            User-Name:  64-31-50-77-5A-A2
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  N/A
              ACS ACL:  xACSACLx-IP-POSTURE_REMEDIATION-53a84454
     URL Redirect ACL:  ACL-POSTURE-REDIRECT
         URL Redirect:  https://xxxxxx:8443/guestportal/gateway?sessionId=AC101E6400000006000107B7&action=cwa
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  AC101E6400000006000107B7
      Acct Session ID:  0x00000008
               Handle:  0xC9000007

Runnable methods list:
       Method   State
       mab      Authc Success
       dot1x    Not run
SW-ISE#show epm session ip 172.16.1.2
    Admission feature:  DOT1X
              ACS ACL:  xACSACLx-IP-POSTURE_REMEDIATION-53a84454
     URL Redirect ACL:  ACL-POSTURE-REDIRECT
         URL Redirect:  https://xxxxxx:8443/guestportal/gateway?sessionId=AC101E6400000006000107B7&action=cwa

-------------------

SW-ISE#show ip access-lists interface fastEthernet 0/1
     permit tcp host 172.16.1.2 host 172.16.30.20 eq 8443
     permit tcp host 172.16.1.2 any eq www
     permit tcp host 172.16.1.2 any eq 443
     permit udp host 172.16.1.2 any eq domain
     permit icmp host 172.16.1.2 any

 

 ip http server
ip http secure-server
!
ip access-list extended ACL-POSTURE-REDIRECT
 deny   ip any host 172.16.30.20
 permit tcp any any eq 443
 permit tcp any any eq www
ip access-list extended default
 permit ip any any
ip radius source-interface Vlan30 
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server dead-criteria time 2 tries 2
radius-server host 172.16.30.20 auth-port 1812 acct-port 1813 key cisco
radius-server vsa send accounting
radius-server vsa send authentication

 

if i put manual link Open, dns is ok, also if from pc telnet to 8443 work!!, the link not redirect manual on client

Cisco Employee

Couple of things:172.16.30.20

Couple of things:

172.16.30.20 is the IP Address of ISE, correct?

Add the following ACE to the top of your ACL:

deny udp any any eq domain

Thank you for rating helpful posts!
150
Views
0
Helpful
5
Replies
CreatePlease login to create content