topic Re: ISE Guest User problem in Network Access Control

ISE Guest User problem

phatrachit — Mon, 11 Mar 2019 01:51:21 GMT

Hi Guys,

I got a problem about Guest user after create guest account from ISE sponsor. When i try to login with guest user on Web authen (WLC) it show login error and the message on ISE is Authentication failed : 24206 User disabled

Failure Reason > Authentication Failure Code Lookup

Failure Reason :

24206 User disabled

Description
User marked disabled in Internal database.

Resolution Steps
Check whether the user account in Internal database is enabled

I would like to know, how to enable the guest account? What i missed configuration?

ISE Guest User problem

DENNIS BAAS — Tue, 28 Feb 2012 09:13:59 GMT

In your sponsorportal: on the left, select menu item View guest Accounts to view your account(s).

Select the affected account and click Reinstate.

It is possible, that your sponsor account does not have the permission to Reinstate/Suspend accounts. Check/change this in your ISE admin page:

- Go to Administration > Guest Management > Sponsor Groups.

- Click the Sponsor Group your sponsor account is a member of to edit.

- Select tab Authorization Levels: view/modify the permission listed for the option Suspend/reinstate Accounts.

ISE Guest User problem

phatrachit — Tue, 28 Feb 2012 10:44:55 GMT

Hi DENNIS

Thank you for reply

I found the solution for solve my problem. I have to configure External Web Authentication on WLC as ISE.

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076f974.shtml

ISE Guest User problem

Dave Anthony David — Wed, 14 Mar 2012 10:22:33 GMT

We have the same problem, creation of guest account using sponsor seems not working.

I reinstate the guest users as what Dennis have said but still guest is disabled.

Pre-auth ACL is already in placed.

Note that when using the guest users created via ISE > Administration > Identity Management > Identities > Users it is working. Here's the snapshot

ISE Guest User problem

phatrachit — Thu, 15 Mar 2012 02:01:41 GMT

Hi dsdavid,

Do you use ISE with WLC? If yes, you need to configure ISE as External Web Auth at WLC?

WLC

Security > Access Control List

Allow traffic from Client to ISE

* If you have firewall or ACL on Core switch between WLC and ISE, you have to allow traffic Client to ISE too.

Security > Web Auth > External Web Auth

Web Authentication Type : External

Redirect URL after login : Up to you

External Webauth URL : https://:8443/guestportal/Login.action

WLAN > Security > Layer 3

- Check Web Policy > Authentication

- Pre-Auth ACL > Choose ACL which you pre-define at Security > Access Control List

WLAN > AAA Servers

- Choose Authentication Server as ISE

WLAN > Advance

- Check Allow AAA override

Re: ISE Guest User problem

Dave Anthony David — Thu, 15 Mar 2012 02:57:44 GMT

Hi Phatrachit,

Thanks for replying. Yes WLC is integrated to ISE. I've recheck all you have said and all of that are properly configured. The only difference is that my External Web Auth is configured under WLAN > Security > Layer 3 (override value) instead of Security > Web Auth > External Web Auth.

By the way, have you noticed when creating guest user using sponsor account, does it appear on Administration > Identity Management > Identities > Users ??

Re: ISE Guest User problem

phatrachit — Thu, 15 Mar 2012 05:12:14 GMT

Hi dsdavid,

- For External Web auth, WLC will check Global configuration (Security > Web Auth) first then check in individual SSID thus try to configure External Web authn at the Security menu. If you have the SSID that need to use internal web auth, you can use override value at WLAN menu.

- Guest user that create on ISE Guest sponsor will not appear on Identities > Users. Those guest user can managed on ISE Guest sponsor only.

BR,

Bhatarajit.P

Re: ISE Guest User problem

Dave Anthony David — Thu, 15 Mar 2012 06:58:29 GMT

Hi Phatrachit,

I have managed to make it work. After all the problem is actually right here (see attached picture).

It was set to Central Web Auth which I forgot to set back to Guest.

Thank you for your time.

Regards,

Dave