topic Re: ISE 2.2 guest features...."Supported with internal & AD/LDAP email address" in Network Access Control

ISE 2.2 guest features...."Supported with internal & AD/LDAP email address"

bechong — Wed, 12 Apr 2017 19:31:55 GMT

In the slide below, what does “Supported with internal & AD/LDAP email addresses? Does this mean the email of the Person being visited will be verified against AD/LDAP? So Guest cannot simply enter JohnDoe@XYZ.com if they implement the Self-Registration workflow?

Re: ISE 2.2 guest features...."Supported with internal & AD/LDAP email address"

Jason Kunst — Wed, 12 Apr 2017 20:12:20 GMT

This means when you enable single click sponsor approval it will validate that the person being visited email address belongs to a valid sponsor

This flow will only work for those sponsors in active directory LDAP or internal use your account it will not work for the SAML

Re: ISE 2.2 guest features...."Supported with internal & AD/LDAP email address"

bechong — Thu, 13 Apr 2017 02:01:48 GMT

Thanks Jason,

Is there email validation if it is a self-registration flow?

Guest user completes the form but fills in an invalid email of the Person being visited. This flow doesn't require approval, but there is still a required email field of the Person being visited. Is this email validated against AD/LDAP?

The customer is considering enabling the self-registration flow with no approval required, but doesn't want any person to be sitting in parking lot within RF range of the Guest SSID and able to complete the self-registration process with a bogus email address.

Re: ISE 2.2 guest features...."Supported with internal & AD/LDAP email address"

Jason Kunst — Thu, 13 Apr 2017 11:24:34 GMT

NO there is no lookup of the person being visited less using single click

frankly I don't see the value as someone could easily find a company email address unless it was limited to a select few accounts even then it's better to use approval for that

instead why not use the self registration page access code to protect the portal?

if customer insist on having directory lookup with approval then please work offline with me by sending customer name as we have it on a list of features