Enter a unique portal name to access this portal. Do not use this portal name for any other Sponsor and Guest portals and non-guest portals, such as Blacklist, Bring Your Own Device (BYOD), Client Provisioning, Mobile Device Management (MDM), or My Devices portals.

This name appears in the authorization profile portal selection for redirection choices, and is used in the list of portals for easy identification among other portals.

Optional.

A system-generated URL displays as a link after you click Save. Use it to test the portal.

Each portal type supports 15 languages by default, which are available as individual properties files bundled together in a single zipped language file. Export or import the zipped language file to use with the portal. The zipped language file contains all the individual language files that you can use to display text for the portal.

The language file contains the mapping to the particular browser locale setting (for example, for French: fr, fr-fr, fr-ca) along with all of the string settings for the entire portal in that language. A single language file contains all the supported languages, so that it can easily be used for translation and localization purposes.

If you change the browser locale setting for one language, the change is applied to all the other end-user web portals. For example, if you change the French.properties browser locale from fr,fr-fr,fr-ca to fr,fr-fr in the Hotspot Guest portal, the change is applied to the My Devices portal also.

Display your company’s network-usage terms and conditions on a separate page to the user.

Assign an access code as the login credential that multiple guests should use to gain access to the network. An access code is primarily a locally known code that is given to physically present guests (either visually via a whiteboard or verbally by a lobby ambassador). It would not be known and used by someone outside the premises to access the network.

You can use this option in addition to the usernames and passwords that are provided as the login credentials to individual guests.

Ensure that the user has read the AUP completely. The Accept button activates only after the user has scrolled to the end of the AUP.

Display additional information after the guests are successfully authenticated and before they are granted network access.

Assign an access code as the login credential that multiple guests should use to gain access to the network. An access code is primarily a locally known code that is given to physically present guests (either visually via a whiteboard or verbally by a lobby ambassador). It would not be known and used by someone outside the premises to access the network.

You can use this option in addition to the usernames and passwords that are provided as the login credentials to individual guests.

Specify the number of failed login attempts from a single browser session before Cisco ISE starts to throttle that account. This does not cause an account lockout. You can specify the time between attempts after this number of failed logins is reached in Time between login attempts when rate limiting.

Set the length of time in minutes that a user must wait before attempting to log in again, after failing to log in the number of times defined in Maximum failed login attempts before rate limiting.

Display your company’s network-usage terms and conditions, either as text on the page currently being displayed for the user or as a link that opens a new tab or window with AUP text.

Require users to accept an AUP before their account is fully enabled. The Login button is not enabled unless the user accepts the AUP. If users do not accept the AUP, they will not obtain network access.

This option displays only if Include an AUP on page is enabled.

Ensure that the user has read the AUP completely. The Accept button activates only after the user has scrolled to the end of the AUP.

Provide an option on this portal’s Login page for guests to register themselves. If this option is not selected, sponsors create guest accounts. Enabling this also enables tabs on this page for you to configure Self-Registration Page Settings and Self-Registration Success Page Settings.

If guests choose this option, they are presented with the Self-Registration form where they can enter the requested information to create their own guest accounts.

Allow guests to change their password after successfully authenticating and accepting the AUP, if it is required.

If guests change their passwords, sponsors cannot provide guests with their login credentials if lost. The sponsor can only reset the guest’s password back to a random password.

Choose the guest type to which all the self-registered guests using this portal should be assigned.

Specify the duration for the account in days, hours, or minutes after which the account will expire unless you or the sponsor extend the account duration in the Sponsor portal.

Assign a code that the self-registering guests must enter to successfully submit their Self-Registration form. Similar to the access code, the registration code is provided to the guest offline to prevent someone who is outside the premises from accessing the system.

Check the fields that you want to display on the Self-Registration form. Then check which fields are mandatory for the guests to complete in order to submit the form and receive a guest account. You may want to require fields such as SMS Service Provider and Person being Visited to gather important information from self-registering guests.

Enter locations that the self-registering guests can select at registration time using the list of locations that you have defined. This automatically assigns the related time zones as the valid access times for these guests. The location names should be clear to avoid ambiguity during selection (for example, Boston Office, 500 Park Ave New York, Singapore, etc.)

If you only provided one location, it is automatically assigned as the default location and does not display in the portal for guests to view. Additionally, Location is disabled in the list of Fields to include.

Display SMS providers on the Self-Registration form to enable self-registering guests to choose their own SMS provider. You can then use the guest’s SMS service to send them SMS notifications to minimize expenses for your company.

Select the SMS providers that should display on the Self-Registration form.

If you only selected one as the default SMS provider for the guest to use, it will not display on the Self-Registration form.

Select additional information that you would like collect from the self-registering guests. Then check which fields are mandatory for the guests to complete in order to submit the Self-Registration form and receive a guest account. These fields are listed in alphabetical order by name.

Display your company’s network-usage terms and conditions, either as text on the page currently being displayed for the user or as a link that opens a new tab or window with AUP text.

Require users to accept an AUP before their account is fully enabled. The Login button is not enabled unless the user accepts the AUP. If users do not accept the AUP, they will not obtain network access.

This option displays only if Include an AUP on page is enabled.

Ensure that the user has read the AUP completely. The Accept button activates only after the user has scrolled to the end of the AUP.

Specify the whitelisted email address domains from which the self-registering guests can enter in Email Address and successfully receive their account credentials; for example, cisco.com, example.com.

In this example, if the guests entered myname@cisco.com as their email address, after successful account creation, they receive their login credentials. However, if they entered myname@hotmail.com (or any other address not from cisco.com or example.com), no account is created and they do not get credentials.

Leaving this field blank allows registration from any domain, unless there are blacklist domains listed in Do not allow guests with email address from.

Specify the blacklisted email address domains from which the self-registering guests cannot enter in Email Address and successfully receive their account credentials; for example, cisco.com, example.com.

In this example, if the guests entered myname@cisco.com as their email address, no account is created and they do not get credentials.

Specify that the self-registering guests using this portal require approval from a sponsor before receiving their guest credentials.

Then specify one of the options under After registration submission, direct guest to in this page:

If enabled, you should also enable one or both: Email or SMS under Send credential notification upon approval using in this page.

Enabling Require self-registered guests to be approved enables the following extra configuaration fields, which have the following attributes:

If you select:

These persons will receive an email notification stating that self-registering guests require approval.

Direct successfully self-registered guests to the Self-Registration Success page, which displays the fields and messages you have specified in Self Registration Success Page Settings.

It may not be desirable to display all the information, because the system may be awaiting account approval (if enabled on this page) or delivering the login credentials to an email address or phone number based on the whitelisted and blacklisted domains specified in this page.

If you enabled Allow guests to log in directly from the Self-Registration Success page in Self-Registration Success Page Settings, successfully self-registered guests can log in directly from this page. If it is not enabled, they are directed to the portal's Login page after the Self-Registration Success page is displayed.

Direct successfully self-registered guests back to the portal’s Login page and display a message, such as “Please wait for your guest credentials to be delivered either via email, SMS, or print format and proceed with logging in.”

To customize the default message, click on the Portal Page Customization tab and select Self-Registration Page Settings.

The system may be awaiting account approval (if enabled on this page) or delivering the login credentials to an email address or phone number based on the whitelisted and blacklisted domains specified in this page.

Direct successfully self-registered guests to the specified URL while waiting for their account credentials to be delivered.

The system may be awaiting account approval (if enabled on this page) or delivering the login credentials to an email address or phone number based on the whitelisted and blacklisted domains specified in this page.

Choose email as the option by which successfully self-registered guests receive their login credential information. If you choose this option, Email address becomes a required field in the list of Fields to include and you can no longer disable this option.

Choose SMS as the option by which successfully self-registered guests receive their login credential information. If you choose this option, SMS Service Provider becomes a required field in the list of Fields to include and you can no longer disable this option.

Check the fields that you want to display for the successfully self-registered guests on the Self-Registration Success page.

If sponsor approval of the guest is not required, check Username and Password to display these credentials for the guest. If sponsor approval is required, these fields are disabled, because the credentials can only be delivered to the guest after they have been approved.

Check the options by which the successfully self-registered guest can send credential information to themselves: Print, Email, or SMS.

Display your company’s network-usage terms and conditions, either as text on the page currently being displayed for the user or as a link that opens a new tab or window with AUP text.

Require users to accept an AUP before their account is fully enabled. The Login button is not enabled unless the user accepts the AUP. If users do not accept the AUP, they will not obtain network access.

This field displays if you chose the AUP on page option.

Ensure that the user has read the AUP completely. The Accept button activates only after the user has scrolled to the end of the AUP.

Display a Login button at the bottom of the Self-Registration Success page. This enables the guest to bypass the Login page and automatically deliver the login credentials to the portal and display the next page in the portal flow (for instance, the AUP page).

Display your company’s network-usage terms and conditions on a separate page to the user.

Display a different AUP and network-usage terms and conditions for employees only. If you choose this option, you cannot also choose Skip AUP for employees.

Employees are not required to accept an AUP before accessing the network. If you choose this option, you cannot also choose Use different AUP for employees.

Ensure that the user has read the AUP completely. The Accept button activates only after the user has scrolled to the end of the AUP.

Display an AUP when the user logs into the network or portal for the first time only.

Display an AUP each time the user logs into the network or portal.

Display an AUP periodically after the user first logs into the network or portal.

Automatically create an endpoint for the device from which the guest is accessing this portal. The endpoint will be added to the endpoint identity group specified for this portal and is subject to the identity group's purge policy.

An authorization rule can now be created to allow access to endpoints in that identity group, so that web authentication is no longer required.

If the maximum number of registered devices is reached, the system automatically deletes the first registered device, registers the device the guest is trying to log in with, and notifies them. Choose Guest Access > Configure > Guest Types to change the maximum number of devices with which a guest can register.

Guests can register their devices manually by providing a name, description and MAC address. The MAC address is associated with an endpoint identity group.

If the maximum number of registered devices is reached, the guest is required to delete at least one device before being allowed to register another device.

Add the Employee Bring Your Own Device (BYOD) Registration page to this portal allowing employees to go through the employee device registration process, and possibly native supplicant and certificate provisioning, depending on the settings for Client Provisioning for the employee’s personal device type (for example, iOS, Android, Windows (excluding RT or mobile), OSX).

Choose an endpoint identity group to track guest devices. Cisco ISE provides the GuestEndpoints endpoint identity group to use as a default. You can also create additional endpoint identity groups if you choose to not use the default.

Change the number of days since the registration of a user's device before it is purged from the Cisco ISE database. Purging is done on a daily basis and the purge activity is synchronized with the overall purge timing. The change is applied globally for this endpoint identity group.

If changes are made to the Endpoint Purge Policy based on other policy conditions, this setting is no longer available for use.

Let employees access your guest network and avoid additional provisioning and registration that may be required to access your corporate network.

Display the device ID to the user during the registration process, even though the device ID is pre-configured and cannot be changed while using the BYOD portal .

After successfully authenticating to the network, redirect the user’s browser to the original website that the user is trying to access, if available. If not available, the Authentication Success page displays. Make sure that the redirect URL is allowed to work on port 8443 of the PSN by the access-control list on the NAD and by authorization profiles configured in ISE for that NAD.

For Windows, MAC and Android devices, control is given to the Self-Provisioning Wizard app, which performs the provisioning. Therefore, these devices are not redirected to the originating URL. However, iOS (dot1X) and unsupported devices (that are allowed network access) will be redirected to this URL.

Display a page indicating that the device registration was successful.

After successfully authenticating to the network, redirect the user's browser to the specified URL, such as your company’s website.

Display additional information after the users successfully log in and before they are granted network access.

Use to refresh the IP address for Windows or Mac OS devices after a VLAN change in both wired and wireless environments for a guest.

This affects the Central WebAuth (CWA) flow during final authorization when the network access changes the guest VLAN to a new VLAN. The guest’s old IP address must be released before the VLAN change and a new guest IP address must be requested through DHCP once the new VLAN access is in place. The IP address release renew operation varies by the browser and operating system used; Internet Explorer uses ActiveX controls, and Firefox and Google Chrome use Java applets. For non-Internet Explorer browsers, Java must be installed and enabled on the browser.

The VLAN DHCP Release option does not work on mobile devices. Instead, guests are requested to manually reset the IP address. This method varies by devices. For example, on Apple iOS devices, guests can select the Wi-Fi network and click the Renew Lease button.

Enter the delay to release time. It should be brief because the release must occur immediately after the applet is downloaded and before the Cisco ISE server directs the NAD to re-authenticate with a CoA request.

Enter the time to delay Cisco ISE from executing the CoA. Provide enough time (use the default value as a guideline) to allow the applet to download and perform the IP release on the client.

Enter the delay to renew value. This time is added to the IP release value and does not begin timing until the control is downloaded. Provide enough time (use the default value as a guideline) so that the CoA is allowed to process and the new VLAN access granted.

Display a link to an information page, such as Contact Us, on all enabled pages for the portal.

Include the MAC address of the device on the Support Information page.

Include the IP address of the device on the Support Information page.

Include the browser details such as the product name and version, layout engine and version of the user agent originating the request on the Support Information page.

Include the IP address of the ISE Policy Service Node (PSN) that is serving this portal on the Support Information page.

If available, include the corresponding number from the log message catalog. You can access and view the message catalog by navigating to Administration > System > Logging > Message Catalog.

Do not display any field labels on the Support Information page if the information that they would contain is non-existent. For example, if the failure code is unknown, and therefore blank, do not display Failure code, even if it is selected.

Display all selected field labels on the Support Information page, even if the information that they would contain is non-existent. For example, if the failure code is unknown, display Failure code, even if it is blank.

Display this text in any selected field on the Support Information page, if the information that they would contain is non-existent. For example, if you enter Not Available in this field, and the failure code is unknown, the Failure code will display as Not Available.