- Preface
-
- Administration User Interface Reference
- Guest Access User Interface Reference
- Web Portals Customization Reference
- Policy User Interface Reference
- Operations User Interface Reference
- Network Access Flows
- Switch and Wireless LAN Controller Configuration Required to Support Cisco ISE Functions
- Supported Management Information Bases in Cisco ISE
- Cisco ISE Guest Services
- Guest and Sponsor Accounts
- Guest Accounts
- Manage Guest Accounts
- Guest Types and User Identity Groups
- Configure Access Privileges for Guest Types
- Disable Guest Types
- Purge Expired Guest Accounts
- Add Custom Fields for Guest Account Creation
- Specify Email Addresses and SMTP Servers for Email Notifications
- Assign Locations and SSIDs for Guest Access
- Rules for Guest Password Policies
- Set the Guest Password Policy and Expiration
- Rules for Guest Username Policies
- Set the Guest Username Policy
- Configure SMS Gateways for SMS Notifications
- Sponsor Accounts
- Guest Accounts
- Login Codes and Credentials for Guest Portals
- Guest Access with Hotspot Guest Portals
- Guest Access with Credentialed Guest Portals
- Employee Access with Credentialed Guest Portals
- Guest Device Registration and Compliance
- Guest Portals Configuration Tasks
Configure Guest Access
- Cisco ISE Guest Services
- Guest and Sponsor Accounts
- Guest Portals
- Sponsor Portals
- Monitor Guest and Sponsor Activity
- Guest Access Deployment Scenarios
Cisco ISE Guest Services
Cisco Identity Services Engine (ISE) guest services enable you to provide secure network access to guests such as visitors, contractors, consultants, and customers. You can support guests with base Cisco ISE licenses, and you can choose from several deployment options depending on your company’s infrastructure and feature requirements.
Cisco ISE provides web-based and mobile portals to provide on-boarding for guests (and even employees) to your company’s network and internal resources and services.
From the Admin portal, you can create and edit guest and sponsor portals, configure guest access privileges by defining their guest type, and assign sponsor privileges for creating and managing guest accounts.
End-User Guest and Sponsor Portals in Distributed Environment
Cisco ISE end-user web portals depend on the Administration, Policy Services, and Monitoring personas to provide configuration, session support, and reporting functionality.
Administration Node
Any configuration changes you make to users or devices on the end-user portals are written to the Administration node. If the primary Administration node fails, you can log into the end-user portals, but you cannot create, edit, or delete users or devices until the primary node comes back up or you promote the secondary node.
Policy Services Node
You must run the end-user portals on a Policy Services node, which handles all session traffic, including: network access, client provisioning, guest services, posture, and profiling. If the Policy Service node is part of a node group, and the node fails, the other nodes detect the failure and reset any pending sessions.
Monitoring Node
The Monitoring node collects, aggregates, and reports data about the end user and device activity on the My Devices, Sponsor, and Guest portals. If the primary Monitoring node fails, the secondary Monitoring node automatically becomes the primary Monitoring node.
Guest and Sponsor Accounts
Guest services support various types of users—guests, sponsors, and employees. From the Admin portal, you must define the access privileges and feature support for sponsors. Sponsors then access the Sponsor portal to create and manage guest accounts.
Once their guest accounts are created, guests can use the Sponsored-Guest portal to log in and gain access to the network. Guests can also create their own accounts by registering themselves using the Self-Registered Guest portal and then logging in to the network. Based on the portal configuration, these self-registering guests may need sponsor approval before they can receive their login credentials. Guests can also choose to access the network using the Hotspot Guest portal, which does not require the creation of guest accounts and login credentials such as username and password.
Employees who are included in identity stores (such as Active Directory, LDAP, Internal Users) can also gain access through the credentialed Guest portals (Sponsored-Guest and Self-Registered Guest portals), if configured.
Guest Accounts
Guests typically represent authorized visitors, contractors, customers, or other temporary users who require access to your network. However, you can also use guest accounts for employees if you prefer to use one of the guest deployment scenarios to allow employees to access the network. You can access the Sponsor portal to view guest accounts created by a sponsor and by self-registering guests.
- Manage Guest Accounts
- Guest Types and User Identity Groups
- Configure Access Privileges for Guest Types
- Disable Guest Types
- Purge Expired Guest Accounts
- Add Custom Fields for Guest Account Creation
- Specify Email Addresses and SMTP Servers for Email Notifications
- Assign Locations and SSIDs for Guest Access
- Rules for Guest Password Policies
- Set the Guest Password Policy and Expiration
- Rules for Guest Username Policies
- Set the Guest Username Policy
- Configure SMS Gateways for SMS Notifications
Manage Guest Accounts
Use the Sponsor portal to create temporary accounts for authorized visitors to securely access your corporate network or the Internet. After creating the guest accounts, you also can use the Sponsor portal to manage these accounts and provide account details to the guests.
Guest Types and User Identity Groups
Guest accounts must be associated with a guest type. Guest types allow a sponsor to assign different levels of access and different network connection times to a guest account. These guest types are associated with particular network access policies. Cisco ISE includes these default guest types:
-
Contractor—Users who need access to the network for an extended amount of time, up to a year.
-
Daily—Guests who need access to the resources on the network for just 1 to 5 days.
-
Weekly—Users who need access to the network for a couple of weeks.
When creating guest accounts, certain sponsor groups can be restricted to using specific guest types. Members of such a group can create guests with only the features specified for their guest type. For instance, the sponsor group, ALL_ACCOUNTS, can be set up to use only the Contractor guest type, and the sponsor groups, OWN_ACCOUNTS and GROUP_ACCOUNTS, can be set up to use Daily and Weekly guest types. Also, since self-registering guests using the Self-Registered Guest portal typically need access for just a day, you can assign them the Daily guest type.
The guest type defines the user identity group for a guest. You can configure user identity groups can be configured in . You can delete a user identity group for a guest only by deleting the specific guest type.
Configure Access Privileges for Guest Types
You can use the default guest types and their default access privileges and settings provided by Cisco ISE. If you do not want to use the default options, you can either create new guest types or edit the default guest types and change the settings. Not all changes will apply to guest accounts that have already been created using the guest type. You can also duplicate a guest type to create additional guest types with the same access privileges.
Each guest type has a name, description, and a list of sponsor groups that can create guest accounts with this guest type. You can designate some guest types as follows: use just for self-registering guests, or do not use to create guest accounts (by any sponsor group).
What to Do Next
Disable Guest Types
You cannot delete the last remaining guest type or guest types that are being used by guest accounts. If you want to delete a guest type that is in use, first ensure that it is no longer available for use.
Purge Expired Guest Accounts
When a guest account reaches the end of its account duration (as defined by the sponsor when creating the account), the account expires. When guest accounts expire, the affected guests cannot access the network. Sponsors can extend expired accounts before they are purged. However, after an account is purged, sponsors must create new accounts.
When expired guest accounts are purged, the associated endpoints and reporting and logging information are still retained.
If the Cisco ISE server is down when the purge is scheduled to run, the purge is not executed. The purge process will run again at the next scheduled purge assuming the server is operational at that time.
Add Custom Fields for Guest Account Creation
When providing guest access, you may want to collect information from your guests beyond just their names, email addresses, and phone numbers. Cisco ISE provides custom fields that you can use to collect additional information about guests that is specific to your company’s needs. You can associate the custom fields with guest types and with the Self-Registered Guest and Sponsor portals. Cisco ISE does not provide any default custom fields.
What to Do Next
Specify Email Addresses and SMTP Servers for Email Notifications
Cisco ISE allows you to send emails to sponsors and guests, notifying them of information and instructions. You can configure SMTP servers to deliver these email notifications. You can also specify the email address from which the notifications will be sent to guests.
Sponsors can manually send email notifications to guests to deliver their login credentials and password reset instructions. Sponsors can also receive email notifications requiring their approval for self-registering guests.
During the portal configuration, you can choose to automatically send guests email notifications with their login credentials after they successfully register themselves.
| Step 1 | To specify email settings and configure SMTP servers for all Guest and Sponsor portals, choose . |
| Step 2 | Choose
if you want to add more SMTP servers.
Configure the SMTP server to enable notifications. Enable email notifications to guests is checked by default. If you disable this setting, guests will not receive email notifications regardless of any other settings you may have enabled while configuring Guest and Sponsor portals. |
| Step 3 | Enter the Default “From” email address that is designated for sending email notifications to guests. For example, donotreply@ yourcompany.com. |
| Step 4 | Do one of the
following:
|
| Step 5 | Click Save. If you do not want to save any updates you made to the settings, click Reset to revert to the last saved values. |
Assign Locations and SSIDs for Guest Access
You can configure the locations and the Service Set Identifiers (SSIDs) of the networks that guests can use at these locations. The locations will help you determine the time zones that apply to guest accounts and help define valid time ranges and other time parameters that apply to guests. You can make these locations available to self-registering guests and also provide these locations and SSIDs to sponsors to use when creating guest accounts.
 Note | Assigning locations and SSIDs to guest accounts does not prevent guests from logging in from other locations. |
| Step 1 | To add, edit or delete locations and SSIDs for all Guest and Sponsor portals, choose . | ||
| Step 2 | For
Guest
Locations:
| ||
| Step 3 | For
Guest
SSIDs:
| ||
| Step 4 | Click Save. If you do not want to save any updates you made to the settings, click Reset to revert to the last saved values. |
What to Do Next
If you added a new location or SSID, you can:
-
Provide the SSIDs for sponsors to use when creating guest accounts. See Portal Settings for Sponsor Portals.
-
Assign the locations and associated time zones for sponsors to use when creating guest accounts. See Configure Sponsor Privileges for Sponsor Groups.
-
Assign the locations and associated time zones for self-registering guests using a Self-Registered Guest portal. See Create a Self-Registered Guest Portal.
Rules for Guest Password Policies
-
Changes to the guest password policy do not affect existing accounts, until the guests passwords have expired and need to be changed.
-
Passwords are case sensitive.
-
These special characters <>/%, cannot be used.
-
Minimum length and minimum required characters apply to all passwords.
-
Passwords cannot match usernames.
-
New passwords cannot match current passwords.
-
Guests do not receive notifications prior to password expiration, unlike guest account expiration. When guest passwords expire, either sponsors can reset the password to a random password or guests can log in using their current login credentials and then change their password.
Set the Guest Password Policy and Expiration
You can define the guest password policies for all Guest and Sponsor portals. The guest password policy determines how the password should be generated for all guest accounts. You can create a password policy based upon a mixture of alphabetic, numeric, or special characters. You can also set the number of days after which guest passwords will expire, requiring guests to reset their passwords. This is a global setting affecting all guests.
| Step 1 | Choose > . |
| Step 2 | Enter the Minimum password length (in characters) for the guest passwords. |
| Step 3 | Specify the characters from each character set that can be used by guests to create passwords. Choose one of the following options under Allowed Characters and Minimums to specify the password policy for guests: |
| Step 4 | Enter the minimum number of characters to use from each set. The total number of required characters across the four character sets should not exceed the overall Minimum password length. |
| Step 5 | Choose one of the following
under
Password
Expiration:
|
| Step 6 | Click Save. If you do not want to save any updates you made to the settings, click Reset to revert to the last saved values. |
What to Do Next
You should customize the error messages that are related to the password policy to provide the password requirements.
Rules for Guest Username Policies
-
Changes to the guest username policy do not affect existing accounts, until the guest accounts have expired and need to be changed.
-
Usernames are case sensitive.
-
These special characters <>/%, cannot be used.
-
Minimum length and minimum required characters apply to all system-generated usernames, including usernames based on email addresses.
-
For manual generation of a username, (for example, in the import file), only the minimum username length applies.
-
Usernames cannot match passwords.
-
Guests do not receive notifications prior to their passwords expiring.
Set the Guest Username Policy
You can create guest usernames based on the email address or the first name and last name of the guest. You can also create guest usernames based upon a random mixture of alphabetic, numeric, or special characters. The random guest username policy is used when the sponsor creates random accounts, either when generating usernames for multiple guests in a single operation or when guest names and email addresses are not available. This is a global setting affecting all guests.
| Step 1 | To define the guest username policies for all Guest and Sponsor portals, choose . |
| Step 2 | Enter the Minimum username length (in characters) for the guest usernames. |
| Step 3 | Choose one of the options under Username Criteria for Known Guests to specify the policy for creating usernames for known guests. |
| Step 4 | Choose one of the following options under Characters Allowed in Randomly-Generated Usernames to specify the policy for creating random usernames for guests: |
| Step 5 | Enter the minimum number of characters to use from each set. The total number of characters from the three character sets should not exceed the number specified in Minimum username length. |
| Step 6 | Click Save. If you do not want to save any updates you made to the settings, click Reset to revert to the last saved values. |
What to Do Next
You should customize the error messages that are related to the username policy to provide the username requirements.
Configure SMS Gateways for SMS Notifications
You can configure the SMS gateways used to deliver SMS notifications to guests and sponsors. Cisco ISE provides a default SMS gateway (Click-A-Tell) that you should select for this purpose, if you do not plan to add any more SMS gateways. This SMS service provider will notify any user with an SMS-capable device. You must set up an account for Click-A-Tell before you can use its services.
However, to minimize expenses for your company when you send SMS notifications, we recommend that you add SMS providers that provide free SMS services such as Verizon and AT&T and any providers that your self-registering guests use.
You can allow sponsors to manually send SMS notifications to guests to deliver their login credentials and password reset instructions. Additionally, during the portal configuration, you can choose to automatically send SMS notifications with login credentials to successfully self-registered guests.
What to Do Next
If you configured a new SMS gateway, you can:
-
Select the SMS service provider to use when sending SMS notifications about expiring accounts to guests. See Configure Access Privileges for Guest Types.
-
Specify which of the configured SMS providers should display on the Self-Registration form for self-registering guests to pick from. See Create a Self-Registered Guest Portal.
-
Provide the SMS service providers for sponsors to use when creating guest accounts for guests whose information is available. See Create Accounts Settings for Sponsor Portals.
Sponsor Accounts
Sponsors are a special type of internal user who can create guest accounts using the Sponsor portal. Like other internal users, Cisco ISE authenticates sponsors through a local database, or through external Lightweight Directory Access Protocol (LDAP) or Microsoft Active Directory identity stores. If you are not using an external source, you must create internal user accounts for sponsors in Cisco ISE.
- Sponsor Groups
- Create Sponsor Accounts and Assign to Sponsor Groups
- Configure Sponsor Privileges for Sponsor Groups
Sponsor Groups
The sponsor group configuration defines the permissions and settings for sponsors. Cisco ISE includes these default sponsor groups:
-
ALL_ACCOUNTS—Sponsors who can manage all guest accounts in your Cisco ISE network. As system administrator, you are part of this sponsor group by default.
-
GROUP_ACCOUNTS—Sponsors who can manage the guest accounts created by sponsors from the same sponsor group.
-
OWN_ACCOUNTS—Sponsors who can manage only the guest accounts that they have created.
You can customize the features available to particular sponsor groups, thereby limiting or expanding functionality of the Sponsor portal. For example:
-
You can allow sponsors to create multiple guest accounts in one operation.
-
You can restrict sponsors from managing guest accounts created by other sponsors.
-
You can grant sponsors the authority to approve or deny requests from self-registering guests.
-
You can allow sponsors to delete, suspend, and reinstate guest accounts.
-
You can disable a sponsor group to prevent its members from logging in to the Sponsor portal.
Create Sponsor Accounts and Assign to Sponsor Groups
To create internal sponsor user accounts and specify the sponsors who can use the Sponsor portals:
What to Do Next
You can also create additional user identity groups specific to your organization to use with sponsors. Choose .
Configure Sponsor Privileges for Sponsor Groups
You can use the default sponsor groups and their default settings and privileges provided by Cisco ISE. If you do not want to use the default options, you can either create new sponsor groups or edit the default sponsor groups and change the settings. You can also duplicate a sponsor group to create additional sponsor groups with the same settings and privileges.
You can disable a sponsor group, which prevents the members of the sponsor group from logging into the Sponsor portal. You can delete any of the sponsor groups, except the default sponsor groups provided by Cisco ISE.
| Step 1 | Choose. |
| Step 2 | Enter the identification information in Sponsor group name and Description. |
| Step 3 | Click Members to select user identity groups and add them as members of this sponsor group. |
| Step 4 | Specify the This sponsor group can create accounts using these guest types from the predefined list. You can create additional guest types to assign to this sponsor group using the Create Guest Types at option. |
| Step 5 | Use
Select
the locations that guests will be visiting to specify the locations
(used to set the guest time zones) that sponsors in this sponsor group can
choose from when creating guest accounts. You can add more locations to choose
from using the
Configure guest locations at option.
This will not restrict guests from logging in from other locations. |
| Step 6 | Specify if and how Sponsor Can Create multiple guest accounts, using either an import option (for accounts generated using guest information) or a username prefix option (for randomly generated accounts). You can also specify the amount of accounts that can be created at a time. |
| Step 7 | Use Sponsor Can Manage to restrict which guests accounts the members of this sponsor group can view and manage. |
| Step 8 | Use Sponsor Can to provide additional privileges related to guest passwords and accounts to the members of this sponsor group. The privileges assigned to this sponsor group in Sponsor Can Manage define on which guest accounts sponsors can perform these operations. |
| Step 9 | Click Save and then Close. |
Guest Portals
When people outside your company attempt to use your company’s network to access the Internet or resources and services on your network, you can provide them network access via a variety of Guest portals.
They can either log in via a Hotspot Guest portal without requiring a username and password, or log in via a credentialed Guest portal using login credentials. Even your employees can use these Guest portals to access your company’s network if you want to enable this functionality in Cisco ISE.
There are two types of credentialed Guest portals:
-
Sponsored-Guest portal—Network access is granted by a sponsor who creates accounts for guests.
-
Self-Registered Guest portal—Guests can also create their own accounts, which may need sponsor approval before they are granted network access.
Cisco ISE provides you with the ability to host multiple Guest portals on the Cisco ISE server, including a predefined set of default portals. The default portal themes have standard Cisco branding that you can customize through the Admin portal. You can also choose to further customize a portal by uploading images, logos, and cascading style sheets (CSS) files that are specific to your organization.
- Login Codes and Credentials for Guest Portals
- Guest Access with Hotspot Guest Portals
- Guest Access with Credentialed Guest Portals
- Employee Access with Credentialed Guest Portals
- Guest Device Registration and Compliance
- Guest Portals Configuration Tasks
Login Codes and Credentials for Guest Portals
Cisco ISE provides secured network access by requiring guests to log in using various types of credentials. You can require that guests log in using one or a combination of these credentials.
-
Username—Required. Applies to all guests using end-user portals (except Hotspot Guest portals) and is derived from the username policy. The username policy applies only to system-generated usernames and not to usernames specified using the Guest API programming interface or the self-registering process. You can configure the policy settings that apply to usernames at . Guests can be notified of their username in an email, SMS, or in printed form.
-
Password—Required. Applies to all guests using end-user portals (except Hotspot Guest portals) and is derived from the password policy. You can configure the policy settings that apply to passwords at . Guests can be notified of their password in an email, SMS, or in printed form.
-
Access code—Optional. Applies to guests using the Hotspot Guest and Credentialed Guest portals. An access code is primarily a locally known code that is given to physically present guests (either visually via a whiteboard or verbally by a lobby ambassador). It would not be known and used by someone outside the premises to gain access to the network. If the Access code setting is enabled:
-
Registration code—Optional. Applies to self-registering guests and is similar to an access code in how it is provided to the self-registering guests. If the Registration code setting is enabled, self-registering guests are prompted to enter it on the Self-Registration form.
The username and password can be provided by a sponsor at your company (for sponsored guests), or a Credentialed Guest portal can be configured to allow guests to register themselves to obtain these credentials.
Guest Access with Hotspot Guest Portals
Cisco ISE provides network access functionality that includes “hotspots,” which are access points that guests can use to access the Internet without requiring credentials to log in. When guests connect to the hotspot network with a computer or any device with a web browser and attempt to connect to a website, they are automatically redirected to a Hotspot Guest portal. Both wired and wireless (Wi-Fi) connections are supported with this functionality.
The Hotspot Guest portal is an alternative Guest portal that allows you to provide network access without requiring guests to have usernames and passwords and alleviates the need to manage guest accounts. Instead, Cisco ISE works together with the network access device (NAD) and Device Registration Web Authentication (Device Registration WebAuth) to grant network access directly to the guest devices. Sometimes, guests may be required to log in with an access code. Typically, this is a code that is locally provided to guests who are physically present on a company’s premises.
Guest Access with Credentialed Guest Portals
You can use a credentialed Guest portal to identify and authorize temporary access for external users to internal networks and services, as well as to the Internet. Sponsors can create temporary usernames and passwords for authorized visitors who can access the network by entering these credentials in the portal's Login page.
You can set up a credentialed Guest portal so that guests can log in using a username and password that is obtained:
-
From a sponsor. In this guest flow, guests are greeted by a sponsor, such as a lobby ambassador, when they enter company premises and are set up with individual guest accounts.
-
After they register themselves, using an optional registration code or access code. In this guest flow, guests are able to access the Internet without any human interaction and Cisco ISE ensures that these guests have unique identifiers that can be used for compliance.
-
After they register themselves, using an optional registration code or access code, but only after the request for a guest account is approved by a sponsor. In this guest flow, guests are provided access to the network, but only after an additional level of screening is done.
Cisco ISE enables you to create multiple credentialed Guest portals, which you can use to allow guest access based on different criteria. For example, you might have a portal for monthly contractors that is separate from the portal used for daily visitors.
Employee Access with Credentialed Guest Portals
Employees can also access the network using Credentialed Guest Portals by signing in using their employee credentials if they are part of the identity source sequence that is assigned to these portals.
You can set up a Credentialed Guest portal so that guests can log in using a username and password that is obtained:
Guest Device Registration and Compliance
Guests can now automatically register their devices when logging in to Guest portals. They can also register additional devices up to the maximum limit that you define for their guest type. These devices are registered into endpoint identity groups based on the type of portal used by the guest. For Hotspot Guest portals, the selected endpoint identity group is used, and for credentialed Guest portals, the endpoint identity group is defined as per the guest type of the guest.
When guests and non-guests access the network through credentialed Guest portals, you can check their devices for compliance before they are allowed to gain access. You can route them to a Client Provisioning page and require them to first download the posture agent that checks their posture profile and verifies if their device is compliant. You can do this by enabling the option in the Guest Device Compliance Settings in a credentialed Guest portal, which displays the Client Provisioning page as part of the guest flow.
The Client Provisioning service provides posture assessments and remediations for guests. The Client Provisioning portal is available only with a Central Web Authorization (CWA) guest deployment. The guest login flow performs a CWA, and the credentialed Guest portal is redirected to the Client Provisioning portal after performing acceptable-use-policy and change-password checks. The posture subsystem performs a Change of Authorization (CoA) on the network access device to reauthenticate the client connection once the posture has been assessed.
Guest Devices Keep Losing Network Access
Problem
Guests repeatedly lose network connectivity on their devices, requiring them to reconnect.
You can configure the Credentialed Guests portals to limit guests to a specific number of active user (network) sessions. This situation occurs when guests have more than the configured number of devices connected to the network. To change the default setting for the guest type to which the guest belongs, choose and change the number of Maximum simultaneous logins.
Causes
The user credentials in the supplicant are cached on the devices, allowing the devices to maintain network connectivity. However, because guests are limited to only the configured number of user sessions, their registered devices are continually connecting and disconnecting from the network.
Solution
Guests can force an unused device to terminate its network session by forgetting the network.
Guest Portals Configuration Tasks
You can use a default portal and its default settings such as certificates, endpoint identity group, identity source sequence, portal themes, images, and other details provided by Cisco ISE. If you do not want to use the default settings, you should create a new portal or edit an existing one to meet your needs. You can duplicate a portal if you want to create multiple portals with the same settings.
After creating a new portal or editing a default one, you must authorize the portal for use. Once you authorize a portal for use, any subsequent configuration changes you make are effective immediately.
If you choose to delete a portal, you must first delete any authorization policy rules and authorization profiles associated with it or modify them to use another portal.
| Task | Hotspot Guest Portal | Sponsored-Guest Portal | Self-Registered Guest Portal |
|---|---|---|---|
|
Required |
Required |
Required |
|
|
Required |
Required |
Required |
|
|
Not applicable |
Required |
Required |
|
|
Not applicable |
Required |
Required |
|
|
Required |
Not required (defined by guest type) |
Not required (defined by guest type) |
|
|
Required |
Not applicable |
Not applicable |
|
|
Not applicable |
Required |
Not applicable |
|
|
Not applicable |
Not applicable |
Required |
|
|
Required |
Required |
Required |
|
|
Optional |
Optional |
Optional |
- Enable Policy Services
- Add Certificates
- Create External Identity Sources
- Create Identity Source Sequences
- Create Endpoint Identity Groups
- Create a Hotspot Guest Portal
- Create a Sponsored-Guest Portal
- Create a Self-Registered Guest Portal
- Authorize Portals
- Customize Guest Portals
Enable Policy Services
To support the Cisco ISE end-user web portals, you must enable portal-policy services on the node on which you want to host them.
Add Certificates
If you do not want to use the default certificates, you can add a valid certificate and assign it to a certificate group tag. The default certificate group tag used for all end-user web portals is Default Portal Certificate Group.
| Step 1 | Chose . |
| Step 2 | Add a system certificate and assign it to a certificate group tag that you want to use for the portal. This certificate group tag will be available to select during portal creation or editing. |
| Step 3 | Choose . |
| Step 4 | Select the specific certificate group tag from the Certificate group tag drop-down list that is associated with the newly added certificate. |
Create External Identity Sources
Cisco ISE can connect with external identity sources such as Active Directory, LDAP, RADIUS Token, and RSA SecurID servers to obtain user information for authentication and authorization. External identity sources also includes certificate authentication profiles that you need for certificate-based authentications.
Create Identity Source Sequences
Ensure that you have configured your external identity sources in Cisco ISE.
To perform the following task, you must be a Super Admin or System Admin.
For allowing guest users to authenticate through Local WebAuth, you must configure both the Guest Portal authentication source and the identity source sequence to contain the same identity stores.
| Step 1 | Choose . |
| Step 2 | Enter a name for the identity source sequence. You can also enter an optional description. |
| Step 3 | Check the Select Certificate Authentication Profile check box and choose a certificate authentication profile for certificate-based authentication. |
| Step 4 | Choose the database or databases that you want to include in the identity source sequence in the Selected List box. |
| Step 5 | Rearrange the databases in the Selected list in the order in which you want Cisco ISE to search the databases. |
| Step 6 | Choose one of the following
options in the
Advanced Search List area:
|
| Step 7 | Click Submit to create the identity source sequence that you can then use in policies. |
Create Endpoint Identity Groups
Cisco ISE groups endpoints that it discovers in to the corresponding endpoint identity groups. Cisco ISE comes with several system-defined endpoint identity groups. You can also create additional endpoint identity groups from the Endpoint Identity Groups page. You can edit or delete the endpoint identity groups that you have created. You can only edit the description of the system-defined endpoint identity groups; you cannot edit the name of these groups or delete them.
| Step 1 | Choose . |
| Step 2 | Click Add. |
| Step 3 | Enter the name for the endpoint identity group that you want to create (do not include spaces in the name of the endpoint identity group). |
| Step 4 | Enter the description for the endpoint identity group that you want to create. |
| Step 5 | Click the Parent Group drop-down list to choose an endpoint identity group to which you want to associate the newly created endpoint identity group. |
| Step 6 | Click Submit. |
Create a Hotspot Guest Portal
You can provide a Hotspot Guest portal to enable guests to connect to your network without requiring a username and password to log in. An access code can be required to log in.
You can create a new Hotspot Guest portal, or you can edit or duplicate an existing one. You can delete any Hotspot Guest portal, including the default portal provided by Cisco ISE.
Any changes that you make to the Page Settings on the Portal Behavior and Flow Settings tab are reflected in the graphical flow in the Guest Flow diagram. If you enable a page, such as the AUP page, it appears in the flow and the guest will experience it in the portal. If you disable it, it is removed from the flow and the next enabled page displays for the guest.
All the Page Settings, except the Authentication Success Settings, are optional.
Ensure that you have the required certificates and endpoint identity groups configured for use with this portal.
| Step 1 | Choose . |
| Step 2 | If creating a new portal, in the Create Guest Portal dialog box, select Hotspot Guest Portal as the portal type and click Continue. |
| Step 3 | Provide a unique Portal Name and a Description for the portal. Ensure that the portal name that you use here is not used for any other end-user portals. |
| Step 4 | Use the Language File drop-down menu to export and import language files to use with the portal. |
| Step 5 | Update the default values for ports, Ethernet interfaces, certificate group tags, endpoint identity groups, and so on in Portal Settings, and define behavior that applies to the overall portal. |
| Step 6 | Update the
following settings, which apply to each of the specific pages:
|
| Step 7 | Click Save. A system-generated URL displays as the Portal test URL, which you can use to access the portal and test it. |
What to Do Next
You must authorize the portal in order to use it. You can also customize your portal either before or after you authorize it for use.
Create a Sponsored-Guest Portal
You can provide a Sponsored-Guest portal to enable designated sponsors to grant access to guests.
You can create a new Sponsored-Guest portal, or you can edit or duplicate an existing one. You can delete any Sponsored-Guest portal, including the default portal provided by Cisco ISE.
Any changes that you make to the Page Settings on the Portal Behavior and Flow Settings tab are reflected in the graphical flow in the Guest Flow diagram. If you enable a page, such as the AUP page, it appears in the flow and the guest will experience it in the portal. If you disable it, it is removed from the flow and the next enabled page displays for the guest.
All these page settings enable you to display an Acceptable Use Policy (AUP) for a guest and require its acceptance:
Ensure that you have the required certificates, external identity sources, and identity source sequences configured for use with this portal.
| Step 1 | Choose . |
| Step 2 | If creating a new portal, in the Create Guest Portal dialog box, select Sponsored-Guest Portal as the portal type and click Continue. |
| Step 3 | Provide a unique Portal Name and a Description for the portal. Ensure that the portal name that you use here is not used for any other end-user portals. |
| Step 4 | Use the Language File drop-down menu to export and import language files to use with the portal. |
| Step 5 | Update the default values for ports, Ethernet interfaces, certificate group tags, identity source sequences, and so on in Portal Settings, and define behavior that applies to the overall portal. |
| Step 6 | Update the
following settings, which apply to each of the specific pages:
|
| Step 7 | Click Save. A system-generated URL displays as the Portal test URL, which you can use to access the portal and test it. |
What to Do Next
You must authorize the portal in order to use it. You can also customize your portal either before or after you authorize it for use.
Create a Self-Registered Guest Portal
You can provide a Self-Registered Guest portal to enable guests to register themselves and create their own accounts so they can access the network. You can still require that these accounts be approved by a sponsor before access is granted.
You can create a new Self-Registered Guest portal, or you can edit or duplicate an existing one. You can delete any Self-Registered Guest portal, including the default portal provided by Cisco ISE.
Any changes that you make to the Page Settings on the Portal Behavior and Flow Settings tab are reflected in the graphical flow in the Guest Flow diagram. If you enable a page, such as the AUP page, it appears in the flow and the guest will experience it in the portal. If you disable it, it is removed from the flow and the next enabled page displays for the guest.
All these page settings enable you to display an Acceptable Use Policy (AUP) for a guest and require its acceptance:
Ensure that you have the required certificates, external identity sources, and identity source sequences configured for use with this portal.
| Step 1 | Choose . |
| Step 2 | If creating a new portal, in the Create Guest Portal dialog box, select Self-Registered Guest Portal as the portal type and click Continue. |
| Step 3 | Provide a unique Portal Name and a Description for the portal. Ensure that the portal name that you use here is not used for any other end-user portals. |
| Step 4 | Use the Language File drop-down menu to export and import language files to use with the portal. |
| Step 5 | Update the default values for ports, Ethernet interfaces, certificate group tags, identity source sequences, and so on in Portal Settings, and define behavior that applies to the overall portal. |
| Step 6 | Update the
following settings, which apply to each of the specific pages:
|
| Step 7 | Click Save. A system-generated URL displays as the Portal test URL, which you can use to access the portal and test it. |
What to Do Next
You must authorize the portal in order to use it. You can also customize your portal either before or after you authorize it for use.
Authorize Portals
You must create a portal before you can authorize it.
Create Authorization Profiles
Each portal requires that you set up a special authorization profile for it.
If you do not plan to use a default portal, you must first create the portal so you can associate the portal name with the authorization profile.
What to Do Next
You should create a portal authorization policy rule that uses the newly created authorization profile.
Create Authorization Policy Rules
To configure the redirection URL for a portal to use when responding to the users' (guests, sponsors, employees) access requests, you need to define an authorization policy rule for that portal.
The url-redirect takes the following form based on the portal type, where:
ip:port = the IP address and port number
PortalID = the unique portal name
For a Hotspot Guest portal: https://ip:port/guestportal/gateway?sessionID=SessionIdValue&portal=PortalID&action=cwa&type=drw
For a Mobile Device Management (MDM) portal: https://ip:port/mdmportal/gateway?sessionID=SessionIdValue&portal=PortalID&action=mdm
| Step 1 | Choose to create a new authorization policy rule under Standard policies. | ||
| Step 2 | For
Conditions, select an endpoint identity group that
you want to use for the portal validation. For example, for the Hotspot Guest
portal, select the default
GuestEndpoints
endpoint identity group and, for the MDM portal, select the default
RegisteredDevices endpoint identity group.
| ||
| Step 3 | For Permissions, select the portal authorization profile that you created. |
Customize Guest Portals
You can customize the portal appearance and user (guests, sponsors, or employees as applicable) experience by customizing the portal themes, changing UI elements on the portal pages, and editing error messages and notifications that display to the users.
Sponsor Portals
The Sponsor portal is one of the primary components of Cisco ISE guest services. Using the Sponsor portal, sponsors can create and manage temporary accounts for authorized visitors to securely access the corporate network or the Internet. After creating a guest account, sponsors also can use the Sponsor portal to provide account details to the guest by printing, emailing, or texting. Before providing self-registering guests access to the company network, sponsors may be requested via email to approve their guests’ accounts.
Configure a Sponsor Portal
You can use a default portal and its default settings such as certificates, endpoint identity group, identity source sequence, portal themes, images, and other details provided by Cisco ISE. If you do not want to use the default settings, you should create a new portal or edit an existing one to meet your needs. You can duplicate a portal if you want to create multiple portals with the same settings.
You may want to create multiple sponsor portals if your company has different branding for your corporate office and its retail locations, or if your company has different product brands, or if a city’s offices want different themed portals for the fire, police, and other departments.
These are the tasks related to configuring a Sponsor portal.
| Step 1 | Enable Policy Services. |
| Step 2 | Add Certificates. |
| Step 3 | Create External Identity Sources. |
| Step 4 | Create Identity Source Sequences. |
| Step 5 | Create a Sponsor Portal. |
| Step 6 | (Optional)Customize Sponsor Portals.
You can customize the portal if you want to change its appearance. |
Enable Policy Services
To support the Cisco ISE end-user web portals, you must enable portal-policy services on the node on which you want to host them.
Add Certificates
If you do not want to use the default certificates, you can add a valid certificate and assign it to a certificate group tag. The default certificate group tag used for all end-user web portals is Default Portal Certificate Group.
| Step 1 | Chose . |
| Step 2 | Add a system certificate and assign it to a certificate group tag that you want to use for the portal. This certificate group tag will be available to select during portal creation or editing. |
| Step 3 | Choose . |
| Step 4 | Select the specific certificate group tag from the Certificate Group Tag drop-down list that is associated with the newly added certificate. |
Create External Identity Sources
Cisco ISE can connect with external identity sources such as Active Directory, LDAP, RADIUS Token, and RSA SecurID servers to obtain user information for authentication and authorization. External identity sources also includes certificate authentication profiles that you need for certificate-based authentications.
Create Identity Source Sequences
Ensure that you have configured your external identity sources in Cisco ISE.
To perform the following task, you must be a Super Admin or System Admin.
For allowing guest users to authenticate through Local WebAuth, you must configure both the Guest Portal authentication source and the identity source sequence to contain the same identity stores.
| Step 1 | Choose . |
| Step 2 | Enter a name for the identity source sequence. You can also enter an optional description. |
| Step 3 | Check the Select Certificate Authentication Profile check box and choose a certificate authentication profile for certificate-based authentication. |
| Step 4 | Choose the database or databases that you want to include in the identity source sequence in the Selected List box. |
| Step 5 | Rearrange the databases in the Selected list in the order in which you want Cisco ISE to search the databases. |
| Step 6 | Choose one of the following
options in the
Advanced Search List area:
|
| Step 7 | Click Submit to create the identity source sequence that you can then use in policies. |
Create a Sponsor Portal
You can provide a Sponsor portal to enable sponsors to create, manage, and approve accounts for guests who want to connect to your network to access the internet and internal resources and services.
Cisco ISE provides you with a default Sponsor portal that you can use without having to create another one. However, you can create a new Sponsor portal, or you can edit or duplicate an existing one. You can delete any of these portals, except the default Sponsor portal.
Any changes that you make to the Page Settings on the Portal Behavior and Flow Settings tab are reflected in the graphical flow in the Sponsor Flow diagram. If you enable a page, such as the AUP page, it appears in the flow and the sponsor will experience it in the portal. If you disable it, it is removed from the flow and the next enabled page displays for the sponsor.
Ensure that you have the required certificates, external identity sources, and identity source sequences configured for use with this portal.
| Step 1 | Choose . |
| Step 2 | Provide a unique Portal Name and a Description for the portal. Ensure that the portal name that you use here is not used for any other end-user portals. |
| Step 3 | Use the Language File drop-down menu to export and import language files to use with the portal. |
| Step 4 | Update the default values for ports, Ethernet interfaces, certificate group tags, identity source sequences, and so on in Portal Settings and define behavior that applies to the overall portal. |
| Step 5 | Update the
following settings, which apply to each of the specific pages:
|
| Step 6 | Click Save. A system-generated URL displays as the Portal test URL, which you can use to access the portal and test it. |
What to Do Next
You can customize the portal if you want to change its appearance.
Customize Sponsor Portals
You can customize the portal appearance and user (guests, sponsors, or employees as applicable) experience by customizing the portal themes, changing UI elements on the portal pages, and editing error messages and notifications that display to the users.
Sponsors Cannot Log In to the Sponsor Portal
Problem
“Invalid username or password. Please try again.”
Causes
Solution
Monitor Guest and Sponsor Activity
Cisco ISE provides various reports and logs that allow you to view endpoint and user management information and guest and sponsor activity. Some of the Cisco ISE 1.2 reports have been deprecated, but the information can be viewed in other reports.
You can run these reports either on demand or on a scheduled basis.
| Step 1 | Choose . |
| Step 2 | Under the Report Selector, expand the Guest Access Reports and Endpoints and Users selections to view the various guest, sponsor, and endpoint related reports. |
| Step 3 | Select the
report and choose the data with which you want to search using the
Filters drop-down list.
You can use filters on username, portal name, device name, endpoint identity group and other such data. |
| Step 4 | Select the Time Range during which you want to view the data. |
| Step 5 | Click Run. |
Metrics Dashboard
Cisco ISE provides an at-a-glance view of Authenticated Guests and Active Endpointsin the network in a metrics dashboard that appears on the Cisco ISE Home page.
AUP Acceptance Status Report
The AUP Acceptance Status report displays the acceptance status of the Acceptable Use Policy (AUP) by guests from all the Guest portals. This report is available at: .
You can use the report to track all the accepted and denied AUP connections for a given period of time.
Guest Accounting Report
The Guest Accounting report displays the guest login history for an indicated time period. This report is available at: .
Master Guest Report
The Master Guest report combines data from various reports into a single view enabling you to export data from different reporting sources. You can add more data columns and remove the ones you do not want to view or export. This report is available at . It now includes information that used to be in the deprecated Guest Activity Report.
This report collects all guest activity and provides details about the websites that guest users visit. You can use this report for security auditing purposes to see when guest users accessed the network and what they did on it. To view the guests’ Internet activity, such as the URLs of the websites that they visited, you must first:
Sponsor Login and Audit Report
The Sponsor Login and Audit report is a combined report that tracks:
-
Login activity by the sponsors at the Sponsor portal.
-
Guest-related operations performed by the sponsors in the Sponsor portal.
This report is available at .
Audit Logging for Guest and Sponsor Portals
During specific actions within the Guest and Sponsor portals, audit log messages are sent to the underlying audit system. By default, these messages appear in the /opt/CSCOcpm/logs/localStore/iseLocalStore.log file.
You can configure these messages to be sent by syslog to the monitoring and troubleshooting system and log collector. The monitoring subsystem presents this information in the appropriate sponsor and device audit logs and guest activity logs.
Guest login flow is logged in the audit logs regardless of whether the guest login has passed or failed.
Guest Access Deployment Scenarios
Cisco ISE supports several deployment options to enable secure guest access through Cisco ISE Guest and Web Authentication Services. You can provide wired or wireless guest connectivity using Local or Central Web Authentication and Device Registration Web Authentication.
-
Central Web Authentication (Central WebAuth)—Applies to all Guest portals. Web authentication is done by a central Cisco ISE RADIUS server for both wired and wireless connection requests. Authentication of the guest device is done after an optional access code is entered by the guest at the Hotspot Guest portals and a username and password are entered by the guest at the Credentialed Guest portals.
-
Local Web Authentication (Local WebAuth)—Applies to the Credentialed Guest portals. Serving of the web pages to the guest is done locally either on a network access device (NAD) such as a switch for a wired connection or by the wireless LAN controller (WLC) for a wireless connection. Authentication of the guest device is done after a username and password are entered by the guest at the Credentialed Guest portals.
-
Device Registration Web Authentication (Device Registration WebAuth)—Applies only to the Hotspot Guest portal. Web authentication is done after the guest device is registered and authorized for use by Cisco ISE. Guests are directed to the Hotspot Guest portal where they can gain access to the network through either a wired or wireless connection (without entering a username or password).
- NAD with Central WebAuth Process
- Wireless LAN Controller with Local WebAuth Process
- Wired NAD with Local WebAuth Process
- Device Registration WebAuth Process
NAD with Central WebAuth Process
In this scenario, the network access device (NAD) makes a new authorization request to the Cisco ISE RADIUS server from an unknown endpoint connection. The endpoint then receives a url-redirect to Cisco ISE.
If the guest device is connected to a NAD, the guest service interaction takes the form of a MAC Authentication Bypass (MAB) request that leads to a Guest portal Central WebAuth login. The following is an outline of the subsequent Central Web Authentication (Central WebAuth) process, which applies to both wireless and wired network access devices.
-
The guest device connects to the NAD through a hard-wired connection. There is no 802.1X supplicant on the guest device.
-
An authentication policy with a service type for MAB allows a MAB failure to continue and return a restricted network profile containing a url-redirect for the Central WebAuth user interface.
-
The NAD is configured to post MAB requests to the Cisco ISE RADIUS server.
-
The guest device re-connects, and the NAD initiates a MAB request.
-
The Cisco ISE RADIUS server processes the MAB request and does not find an endpoint for the guest device. This MAB failure resolves to the restricted network profile and returns the url-redirect value in the profile to the NAD in an access-accept.
To support this function, ensure that an authorization policy exists and features the appropriate wired or wireless MAB (under compound conditions) and, optionally, “Session:Posture Status=Unknown” conditions. The NAD uses this value to redirect all guest HTTPS traffic on the default port 8443 to the url-redirect value.
The standard URL value in this case is: https://ip:port/guestportal/gateway?sessionId=NetworkSessionId&portal=<PortalID>&action=cwa.
-
The guest device initiates an HTTP request to any URL via a web browser.
-
The NAD redirects the request to the url-redirect value returned from the initial access-accept.
-
The gateway URL value with action CWA redirects to the Guest portal login page.
-
The guest enters their login credentials and submits the login form.
-
The guest server authenticates the login credentials.
-
Depending on the type of flow, the following occurs:
-
If it is a non-posture flow (authentication without further validation), where the Guest portal is not configured to perform client provisioning, the guest server sends a CoA to the NAD. This CoA causes the NAD to reauthenticate the guest device using the Cisco ISE RADIUS server. A new access-accept is returned to the NAD with the configured network access. If client provisioning is not configured and the VLAN needs to be changed, the Guest portal performs VLAN IP renew. The guest does not have to re-enter login credentials. The username and password entered for the initial login are used automatically.
-
If it is a posture flow, where the Guest portal is configured to perform client provisioning, the guest device web browser displays the Client Provisioning page for posture agent installation and compliance. (You can also optionally configure the client provisioning resource policy to feature a “NetworkAccess:UseCase=GuestFlow” condition.)
Because there is no client provisioning or posture agent for Linux, the Guest portal redirects to the Client Provisioning portal, which in turn redirects back to a guest authentication servlet to perform optional IP release/renew and then CoA.
With redirection to the Client Provisioning portal, the Client Provisioning service downloads a non-persistent web agent to the guest device and performs a posture check of the device. (You can optionally configure the posture policy with a “NetworkAccess:UseCase=GuestFlow” condition.)
If the guest device is non-compliant, ensure that you have configured an authorization policy that features “NetworkAccess:UseCase=GuestFlow” and “Session:Posture Status=NonCompliant” conditions.
When the guest device is compliant, ensure that you have an authorization policy configured with the conditions “NetworkAccess:UseCase=GuestFlow” and “Session:Posture Status=Compliant.” From here, the Client Provisioning service issues a CoA to the NAD. This CoA causes the NAD to reauthenticate the guest using the Cisco ISE RADIUS server. A new access-accept is returned to the NAD with the configured network access.
Note
“NetworkAccess:UseCase=GuestFlow” can also apply for Active Directory (AD) and LDAP users who log in as guests.
-
Wireless LAN Controller with Local WebAuth Process
In this scenario, the guest logs in and is directed to the wireless LAN controller (WLC). The WLC then redirects the guest to a Guest portal, where they are prompted to enter their login credentials, accept an optional Acceptable Use Policy (AUP), and perform an optional password change. When this is complete, the guest device’s browser is redirected back to the WLC to provide login credentials via a POST.
The WLC can now log the guest in via the Cisco ISE RADIUS server. When this is complete, the WLC redirects the guest device's browser to the original URL destination. The Wireless LAN Controller (WLC) and the network access devices (NAD) requirements to support the original URL redirect for guest portals are WLC 5760 and Cisco Catalyst 3850, 2000, 3000, and 4000 Series Access Switches running releases IOS-XE 3.6.0.E and 15.2(2)E.
Wired NAD with Local WebAuth Process
In this scenario, the Guest portal redirects the guest login request to the switch (wired NAD). The login request is in the form of an HTTPS URL posted to the switch and contains the login credentials. The switch receives the guest login request and authenticates the guest using the configured Cisco ISE RADIUS server.
-
Cisco ISE requires a login.html file with the HTML redirect to be uploaded to the NAD. This login.html file is returned to the browser of the guest device for any HTTPS request made.
-
The browser of the guest device is redirected to the Guest portal where the guest’s login credentials are entered.
-
After the Acceptable Use Policy (AUP) and change password are processed, both of which are optional, the Guest portal redirects the browser of the guest device to post the login credentials on the NAD.
-
The NAD makes a RADIUS request to the Cisco ISE RADIUS server to authenticate and authorize the guest.
- IP Address and Port Values Required for the Login.html Page
- HTTPS Server Enabled on the NAD
- Support for Customized Authentication Proxy Web Pages on the NAD
- Configure Web Authentication on the NAD
IP Address and Port Values Required for the Login.html Page
The IP address and port values must be changed in the following HTML code for the login.html page to those values being used by the Cisco ISE Policy Services nodes. The default port is 8443, but you can change this value, so ensure that the value you assign to the switch matches the setting in Cisco ISE.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <head> <title>ISE Guest Portal</title> <meta Http-Equiv="Cache-Control" Content="no-cache"> <meta Http-Equiv="Pragma" Content="no-cache"> <meta Http-Equiv="Expires" Content="0"> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> <meta http-equiv="REFRESH" content="0;url=https://ip:port/portal/PortalSetup.action?switch_url=wired"> </HEAD> <BODY> <center> Redirecting ... Login <br> <br> <a href="https://ip:port/portal/PortalSetup.action?switch_url=wired">ISE Guest Portal</a> </center> </BODY> </HTML>
Because the custom login page is a public web form, consider these guidelines:
HTTPS Server Enabled on the NAD
To use web-based authentication, you must enable the HTTPS server within the switch using the ip http secure-server command.
Support for Customized Authentication Proxy Web Pages on the NAD
You can upload custom pages for success, expiry, and failure to the NAD. Cisco ISE does not require any specific customization, so you can create these pages using the standard configuration instructions included with the NAD.
Configure Web Authentication on the NAD
You need to complete the web authentication on the NAD by replacing the default HTML pages with your custom files.
During web-based authentication, create four substitute HTML pages to use instead of the switch default HTML pages.
| Step 1 | To specify the use of your custom authentication proxy web pages, first store your custom HTML files on the switch flash memory. To copy your HTML files to the switch flash memory, run the following command on the switch: | ||||||||||||
| Step 2 | After copying your HTML files
to the switch, perform the following commands in global configuration mode:
| ||||||||||||
| Step 3 | Configure the customized authentication proxy web pages following the guidelines provided by the switch. | ||||||||||||
| Step 4 | Verify the configuration of a
custom authentication proxy web page, as shown in the following example:
Switch# show ip admission configuration Authentication proxy webpage Login page : flash:login.htm Success page : flash:success.htm Fail Page : flash:fail.htm Login expired Page : flash:expired.htm Authentication global cache time is 60 minutes Authentication global absolute time is 0 minutes Authentication global init state time is 2 minutes Authentication Proxy Session ratelimit is 100 Authentication Proxy Watch-list is disabled Authentication Proxy Auditing is disabled Max Login attempts per user is 5 |
Device Registration WebAuth Process
Using Device Registration Web Authentication (Device Registration WebAuth) and the Hotspot Guest portal, you can allow guest devices to connect to a private network without requiring usernames and passwords.
In this scenario, the guest connects to the network with a wireless connection. See Figure 16-1 for an example of the Device Registration WebAuth process flow. The following is an outline of the subsequent Device Registration WebAuth process, which is similar for both wireless and wired connections:
-
The network access device (NAD) sends a redirect to the Hotspot Guest portal.
-
If the MAC address of the guest device is not in any endpoint identity group or is not marked with an Acceptable Use Policy (AUP) accepted attribute set to true, Cisco ISE responds with a URL redirection specified in an authorization profile.
-
The URL redirection presents the guest with an AUP page (if enabled) when the guest attempts to access any URL.
-
If the guest accepts the AUP, the endpoint associated with their device MAC address is assigned to the configured endpoint identity group. This endpoint is now marked with an AUP accepted attribute set to true, to track the guest acceptance of the AUP.
-
If the guest does not accept the AUP or if an error occurs, for instance, while creating or updating the endpoint, an error message displays.
-
-
Based on the Hotspot Guest portal configuration, a post-access banner page (if enabled) with additional information may appear.
-
After the endpoint is created or updated, a Change of Authorization (CoA) termination is sent to the NAD.
-
After the CoA, the NAD re-authenticates the guest connection with a new MAC Auth Bypass (MAB) request. The new authentication finds the endpoint with its associated endpoint identity group, and returns the configured access to the NAD.
-
Based on the Hotspot Guest portal configuration, the guest is directed to the URL to which they requested access, or to a custom URL specified by the administrator, or to an Authentication Success Page.
The CoA type for both wired and wireless is Termination CoA. You can configure the Hotspot Guest portal to perform VLAN DHCP Release (and renew), thereby re-authorizing the CoA type for both wired and wireless to Change of Auth.
VLAN DHCP Release support is available for Mac OS and Windows on desktop devices only. It is not available for mobile devices. If the device being registered is mobile and the VLAN DHCP Release option is enabled, the guest is requested to manually renew their IP address. For mobile device users, we recommend using Access Control Lists (ACLs) on the WLC, rather than using VLANs.
Feedback