topic Re: Sponsor created guest - timezone not working? in Network Access Control

Sponsor created guest - timezone not working?

dazza_johnson — Mon, 14 Aug 2017 06:58:32 GMT

I'm trying to understand how ISE uses the timezone in the Sponsor Portal. What I "thought" would happen, is that when I select the Location (timezone) in the red rectangle below, the 'from time' in the green rectangle would be updated to be in the current time in that timezone. That isn't happening though.

I have created all the timezones and locations. But when I create a guest account the location seems irrelevant and the start time is set to the ISE current time, not that of my guest. So when a guest tries to log in I get the dreaded 'Account is not yet active' message, because the timezone was not taken into consideration.

When my guest self registers, the timezone is correctly taken into consideration - so its 'just' the account created by the Sponsor.

Can anyone help? I'm running ISE v2.2 patch 2.

Re: Sponsor created guest - timezone not working?

hslai — Tue, 15 Aug 2017 01:14:32 GMT

Unfortunately, this has been like this since ISE 1.3.

The initial data in the Date/Time fields are populated from that of the sponsor's desktop rather than that of the ISE server's.

[2017-Aug-18] Jason said that The timezone is automatically selected since 2.2.

Re: Sponsor created guest - timezone not working?

ognyan.totev — Tue, 22 Aug 2017 05:47:39 GMT

I think there will be 2 things mention. 1

Sponsor Can Manage

Only accounts sponsor has created

Accounts created by members of this sponsor group

All guest accounts

And the second i think maybe NTP ,i think ISE synchonize his time with NTP ,i dont know but if u have multiple domains in different time zones what it happen. And what you include sponsor can manage which ones time zone and which ones location.

Re: Sponsor created guest - timezone not working?

dazza_johnson — Tue, 22 Aug 2017 06:23:00 GMT

Thanks, it is none of these actually. As per an earlier post this is a defect, the bug can be seen here;

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf62998/?reffering_site=dumpcr

I'm amazed this has not been fixed on or before v2.2 - seems quite an elementary feature.

Darren

Re: Sponsor created guest - timezone not working?

maas0r — Tue, 20 Nov 2018 11:14:18 GMT

I know this issue is getting fixed with Version 2.4 (or something like this). But at the moment we are not able to make an update and I know that we have to live with this bug so far.

But I just wanted to know how ISE gets the timezone for the Sponsorportal:

When I create a ticket the starting time is my local time where I live. When a person in China creates a ticket, it's the local time in China. Last time a guy from turkey created a ticket and the time was 2 hours ahead his local time in Istanbul.

I can't figure out where those times come from. Does it use the computer time or reads out the browser for location and gets the time from an NTP server. I can't imagine that the guy in Istanbul will have a wrong computer time on his machine.

It would be very helpful just to know the algorithm behind so we can offer at least a workaround to our customers.

Re: Sponsor created guest - timezone not working?

Jason Kunst — Tue, 20 Nov 2018 12:28:04 GMT

The time is from the local browser.

Have you tried creating guest accounts types from first login? These accounts are activated right away.

Do you really need to worry about time zones?

Check out discussion in the guest deployment guide and the blog on this page
https://community.cisco.com/t5/security-documents/ise-guest-amp-web-authentication/ta-p/3657224

Might be some bugs too

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf62998

Re: Sponsor created guest - timezone not working?

paul — Tue, 20 Nov 2018 17:37:40 GMT

I agree with Jason on this one. All of my ISE guest setups are from first login. It makes the sponsor process easier and you aren't susceptible to time related issues like this. My normal sponsors will have two options Daily and Weekly guest (based on customer requirements). My elevated sponsors will have Daily, Weekly and Custom guest options. The only thing the sponsor has to worry about is picking the correct guest type and modify the # of days the guest has access from first login.

Re: Sponsor created guest - timezone not working?

maas0r — Wed, 21 Nov 2018 07:23:48 GMT

Thanks a lot for your helpful reply Paul.

It's obvious that this workaround or solution would make everything easier, but we have a security team which is not amused about this way, because you can't tell at what time the guests exactly have access to the network.

But thanks anyway!!