topic ISE 2.2 changes in Sponsor Flows in Network Access Control

ISE 2.2 changes in Sponsor Flows

Oliver Laue — Tue, 18 Jul 2017 10:34:10 GMT

Hi,

i recently updated a customer environment to ISE 2.2p1 and we noticed some strange things in the Sponsor Flows. Did someone has any Information on the following things?

If you disable the global E-Mail feature for Guest "Work Centers - Guest Access - Settings - Guest Email Settings" you can't send SMS Notifications to a SMTP based SMS Gateway

If you remove the Sponsor permission to view/print Guest Password you can't send SMS Notifications with the Error: SMS couldn't be send. fixed in 2.2p2

Guest debug logs on the node show:

cisco.cpm.guestaccess.exception.GuestAccessSystemException -:sponsor:- Sponsor user does not have permission to view passwords on guest accounts

2017-07-16 10:56:26,108 ERROR [http-bio-172.16.1.71-8445-exec-5][] cpm.sponsorportal.actions.api.SelectionBasedAction -:sponsor:- SPONSOR_PORTAL--: com.cisco.cpm.sponsorportal.actions.impl.ResendGuestsAction

com.cisco.cpm.guestaccess.apiservices.exception.PortalSystemException: Error while generating SMS

at com.cisco.cpm.guestaccess.apiservices.sponsor.SponsorUserServiceImpl.sendSMS(SponsorUserServiceImpl.java:2686)

Even if you disable the global Email feature for Guests the Button for Mail Notification is shown. CSCvb61109 not public but seen on other forum post

Password reset Notification SMS always sends html tags. Even if you remove them <p> </p> is automatically added to the text box

and still the old Problem if you reset a Guest Password the Guest is not required to change the Password after login.

Re: ISE 2.2 changes in Sponsor Flows

hslai — Wed, 19 Jul 2017 21:39:25 GMT

CSCvb61109 has no TAC cases attached to it so far. That is the main reason it remains internal only. However, that does not seem related to any of the issues here.

As you mentioned they are found in a customer deployment, I would suggest to engage Cisco TAC to look further. Otherwise, please expand on which particular previous release each of the issues differing from and in what way.

Re: ISE 2.2 changes in Sponsor Flows

Oliver Laue — Thu, 20 Jul 2017 05:30:47 GMT

going to Install the fresh released Patch 2 for 2.2.

According to release Notes the Patch fixes the Issue SMS can't be sind if Permission View/Print Password isn't set.

Re: ISE 2.2 changes in Sponsor Flows

Arne Bier — Thu, 20 Jul 2017 22:53:11 GMT

thanks for the tip off about patch 2 - didn't even know it was out. I thought I set an alert on CCO but I think it only runs once a week. No idea.

Perhaps someone in the BU can make a flash announcement as soon as any patch is released. There are some pretty shocking defects that have been fixed - seems like a no brainer.

I would like to understand how the BU maintains all the streams of ISE releases - 2.1.x , 2.2.x and soon 2.3.x ? Are bugs that are found in 2.3 also retrofitted into 2.2 if applicable?

Re: ISE 2.2 changes in Sponsor Flows

Jason Kunst — Fri, 21 Jul 2017 02:19:07 GMT

Please open a new thread with relevant title

Re: ISE 2.2 changes in Sponsor Flows

Oliver Laue — Fri, 21 Jul 2017 12:29:54 GMT

After Installing Patch 2 it seems like there is a new bug.

Sponsor didn't have permission to view password

If you reset the Password for a guest and send the Password via SMS the Notifications contains either the original system generated password or '....' after the password was changed by the user

I didn't had a chance to test if the old password or the initial password is still working as i wasn't onsite.

Re: ISE 2.2 changes in Sponsor Flows

thomas — Fri, 21 Jul 2017 16:28:53 GMT

Please open a TAC case.

This is not the place to troubleshoot a production deployment.

Re: ISE 2.2 changes in Sponsor Flows

thomas — Mon, 24 Jul 2017 19:23:02 GMT

CCO Software alerts happen on Mondays according to the emails in my Inbox.

See my post Software Release Notifications to get them for ISE and other products.