topic Re: Guest: bypass sponsor approval based on email domain in Network Access Control

Guest: bypass sponsor approval based on email domain

ralagatt — Wed, 11 Jan 2017 14:19:32 GMT

Hello,

My customer is asking if it is possible with self-registration with sponsor approval workflow to bypass sponsor approval if the guest registers with a specific email domain.

Example:

- @Domain.com (whitelist) --> bypass sponsor approval

- any other domain --> require sponsor approval

I remember that sponsor approval is a global workflow option, and I’m not sure it can be turned off based on domain whitelist.

If it is not possible, the other option would be to create a different SSID?

Thanks

Re: Guest: bypass sponsor approval based on email domain

Jason Kunst — Wed, 11 Jan 2017 14:35:01 GMT

Correct have to do another portal and restrict email domains that can register using this portal

There maybe an advanced option where you have one portal link to another portal but this would have to be worked offline and discussed as required advanced customization

Who are the users under the special domain?

Re: Guest: bypass sponsor approval based on email domain

ralagatt — Wed, 11 Jan 2017 15:03:16 GMT

These are corporate users, who can register for guest services (only internet access).

Any other guest would have to go for sponsor approval.

Re: Guest: bypass sponsor approval based on email domain

Jason Kunst — Wed, 11 Jan 2017 15:08:37 GMT

Have they thought about just allowing them to put in their AD credentials to get guest access? This way they don’t have to create guest accounts?

Re: Guest: bypass sponsor approval based on email domain

ralagatt — Wed, 11 Jan 2017 15:19:25 GMT

These would be corporate users from different countries/regions, different ADs.

There is just trust relationship between the various ADs, they do not have unified policies or even solutions.

I know ISE supports multi-forest AD, can we leverage this function and allow these users to have only internet access when connected to the main corporate SSID?

Example:

- If local corporate (country A) user connects to corporate SSID (country A) --> unrestricted access

- If remote corporate user (country B) connects to corporate SSID (Country A) --> internet access only

Any other guest would connect to Guest-SSID, and require sponsor approval.

Re: Guest: bypass sponsor approval based on email domain

Jason Kunst — Wed, 11 Jan 2017 16:05:37 GMT

Yes should be possible lets dicuss offline, send me a webex for late today