topic Cisco ISE Guest account Account duration discrepancy in Network Access Control

Cisco ISE Guest account Account duration discrepancy

mlaurencik — Fri, 09 Sep 2022 12:53:59 GMT

Hello experts !

We use Cisco ISE for guest provisioning and our customer reported interesting issue. For a specific Guest account type, we have set the account "Maximum account duration" to 30 days, counted "From first login", however when sponsor generates a guest account, the email received by the guest displays: ~~"Time left: 14 days".~~ "Valid To: 30 days From First Login", however the Sponsor Admin portal says: "Time left: 14 days". Guest Account Purge Policy is set to Every 15 days. Am I missing anything here, please?

Cisco ISE 2.6.0.156 patch 9,10

Re: Cisco ISE Guest account Account duration discrepancy

Janne K. — Fri, 09 Sep 2022 11:02:30 GMT

what does it say in the sponsor administration portal? is it also 14 days there?

try to look under Work center->guest access->settings->guest account purge policy.
as soon as the account gets activated it should display the correct time

Re: Cisco ISE Guest account Account duration discrepancy

mlaurencik — Fri, 09 Sep 2022 13:58:46 GMT

Hello Janne, I checked what you asked for and corrected my problem description. IT is the Sponsor portal where we see 14 days vs, guest's email showing 30 days. Guest purge policy is set to 15 days. Still, I don't see a clear the logic here. thanks.

Re: Cisco ISE Guest account Account duration discrepancy

Janne K. — Mon, 12 Sep 2022 06:44:09 GMT

What happens when you activate/use the guest account? Does it still display the wrong time?

I'm not sure how it looks in ver 2.6 but under Work center->guest access->settings->guest account purge policy
you should see something in the line of "Expire portal-user information after: xxx days"

Re: Cisco ISE Guest account Account duration discrepancy

mlaurencik — Mon, 12 Sep 2022 13:50:55 GMT

This seems to be the explanation. Until the account is activated, the "Time left" in the Sponsor Admin Portal does show a value representing a time of non-activated account until it will be purged. The expiration time is set under Work center->Guest access->Settings->Guest account purge policy-> "Expire portal-user information after:"

Once the account is activated, the "Time left" value represents the "real" remaining time until an active account expires.