topic Guest Active directory with Any-connect in Network Access Control

Guest Active directory with Any-connect

NetworkSupport00025 — Sat, 08 May 2021 11:50:54 GMT

I'm trying to set up a Guest AD for guest users using the wired method. however, I don't want those users to join that domain since they will temporarily be using this domain when they are connected to my network. can I use cisco anyconnect as Dot1x agent by supplying only the user's name and password to the anyconnect agent without the need to let the users join the domin.

Note: No posture policy applied only dot.1x

Re: Guest Active directory with Any-connect

balaji.bandi — Sat, 08 May 2021 11:56:07 GMT

you can use the guest portal to authenticate users? is there any specific port the guest user connect or any ports in the network, if any port in the network may be bit tricky, but if the user have specific port allocated for guest users, portal is good option,

Again what resources to give based on the profiles and access control (if your policies)

Re: Guest Active directory with Any-connect

NetworkSupport00025 — Sat, 08 May 2021 12:19:54 GMT

Actually, No specific ports for the Guest If it authenticated successfully it will get PACL for the Guest based on the authorization profile.

Re: Guest Active directory with Any-connect

balaji.bandi — Sat, 08 May 2021 17:28:06 GMT

have a look at this document that may help you :

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

https://ciscocustomer.lookbookhq.com/iseguidedjourney/BYOD-configuration?utm_campaign=ISE&utm_content=Guide&utm_source=Cisco.com-Open&utm_medium=ISE-Page-BYOD&pfhide=true

Re: Guest Active directory with Any-connect

thomas — Sat, 08 May 2021 19:23:25 GMT

Don't bother with adding users to AD, just add them to the ISE internal guests store via Self-Registered Guest portal or Sponsored Guest Portal. They can use any native supplicant - no need to install AnyConnect.

Re: Guest Active directory with Any-connect

Romzy — Sun, 09 May 2021 04:38:17 GMT

You absolutely don't need AD for that... Just use ISE to register your guests and it will provide credentials that they can use to login (via guest portal) against ISE' Guest directory.