topic Sponsor mail and AD Existence in Network Access Control

Sponsor mail and AD Existence

nanu — Mon, 10 Feb 2020 18:35:24 GMT

Hi Team,

We have experiencing some problems in ISE deployment, basically about the sponsor mail.

We configured for guests "Person being visited" so its mandatory to add the mail of the sponsored visited.

The issue comes when ISE is permitting send mail to anyone (if its in AD or not), this is a normal behavior? AFAIK ISE checks inside AD if the email address exists, if not exists the mail isn't sended.

How can we force (restrict) that only people inside sponsor group (AD mapped group) have the opportunity of receive mail?

So, i.e the company domain is example1.com, inside AD Group a sponsor with mail account user1@example1.com, if I fill the guest portal with email to person being visited with user2@example2.com, the mail is sended (example2.com is outside our company).

Thank you in advance,

Re: Sponsor mail and AD Existence

Parag Mahajan — Mon, 10 Feb 2020 19:34:30 GMT

https://community.cisco.com/t5/security-documents/ise-guest-self-registration-restrict-validate-the-person-being/ta-p/3637001

Re: Sponsor mail and AD Existence

nanu — Mon, 10 Feb 2020 19:43:00 GMT

Hi Parag,

It isn't checked in AD?

Thank you,

Re: Sponsor mail and AD Existence

Greg Gibbs — Mon, 10 Feb 2020 22:51:13 GMT

No, ISE does not check the email account specified as the person being visited against AD.

You might have a look at the following post for additional options on limiting the email addresses available:

ISE Guest Self-Registration person being visited (sponsor) choose list or assign

Cheers,

Greg

Re: Sponsor mail and AD Existence

nanu — Tue, 11 Feb 2020 15:13:55 GMT

That's OK, I will apply one of your recommendations,

Thank you!

Re: Sponsor mail and AD Existence

nanu — Wed, 19 Feb 2020 09:42:04 GMT

Hi Greg,

I want to add another last question to this topic.

Actually we solve the domain issue, so only mails to company users will be sended.

But, how can limit inside the company who can receive mails?

Regarding these post looks like ISE is checking against AD:

https://community.cisco.com/t5/identity-services-engine-ise/ise-2-2-guest-features-quot-supported-with-internal-ad-ldap/td-p/3601338

Also this bug:

https://quickview.cloudapps.cisco.com/quickview/bug/CSCve76134

Definetely:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01110.html

"If the email address for the sponsor is not for a valid sponsor, the approval email is not sent."

(How ISE can validate if isn't valid Sponsor if not check against AD)

So, what do you think?

Thank you,

Re: Sponsor mail and AD Existence

Greg Gibbs — Wed, 19 Feb 2020 20:25:19 GMT

As per Jason Kunst's post, "NO there is no lookup of the person being visited less using single click"

* I expect this is meant to be "unless using single click"

I'm familiar with the enhancement bug you referenced and I'm not aware that this enhancement has been implemented in any current versions of ISE. From prior customer engagements, I have not seen that ISE does a lookup against AD so we have used the 'choose list' option that I referenced in my previous response as a workaround.

@Jason Kunst, can you confirm the current capabilities around AD/LDAP lookups of 'person being visited' for self-registered Guests?