topic Re: ISE Guest flow with guest user type license required in Network Access Control

ISE Guest flow with guest user type license required

David_D — Tue, 02 Apr 2019 19:25:02 GMT

ISE guest wireless use case consumes a base license: that we know.

If the guest wireless use case now leverages any guest user type (IdentityGroup:Name equals User Identity Groups: GuestType_Contractor), is now a Plus license required?

thanks much,

David D.

Re: ISE Guest flow with guest user type license required

Arne Bier — Tue, 02 Apr 2019 21:57:32 GMT

Nope. EndpointIdentity Groups that you create yourself (or relate to GuestType) don't consume Plus licenses. Plus license only consumed when you use a Group that relates to Profiling (e.g. if device is an Apple device).

Re: ISE Guest flow with guest user type license required

David_D — Wed, 03 Apr 2019 00:14:19 GMT

Hi Arne,

Thanks much for your reply. You are correct. However, my particular use case leverages IdentityGroup:Name (as described in the ISE Guest Prescriptive Deployment Guide) and in this case, Plus licenses ARE expected to be consumed. My reference is the note for Plus licenses in Table 1 of the new ISE Adminstrator guide. https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_0110.html

This must be a new change; eh?

best regards,

David D.

Re: ISE Guest flow with guest user type license required

Jason Kunst — Wed, 03 Apr 2019 14:03:56 GMT

I believe this is because you’re using the Remember me flow. This doesn’t seem right. Please open a defect and tac case and I will escalate it to the Product managers to see what can be done. Send me a direct PM