topic Re: Dynamic Guest Assignment in Network Access Control

Dynamic Guest Assignment

AhmedALJAWAD44875 — Wed, 28 Feb 2024 19:34:54 GMT

Hi Team,

Is there a way the guest can be allowed to access depending on the sponsor's rights?

Example: Guest self-register, then the approval is in an active directory group that has the right to create weekly access

Can I assign the self-register guest weekly access because the sponsor has the weekly access right?

Re: Dynamic Guest Assignment

balaji.bandi — Wed, 28 Feb 2024 19:48:27 GMT

You mean to say you like to add user in Ad Account (hope you consume more AD License if you keep adding the users, you also need to purge them to save license)

high level possible - check the flow guide :

https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475

Re: Dynamic Guest Assignment

AhmedALJAWAD44875 — Wed, 28 Feb 2024 20:01:28 GMT

No , in the guest portal > Registration Form Settings > Assign to guest type For example is Daily but the default

But I need that to depend on the approval sponsors, right? Lets say a guest add my email as the persons he is meeting , I get the email to approve it, my account has right to create guest with 7 days.

I want the guest that I approved to get 7 days not the one day that I have on the guest portal > Registration Form Settings > Assign to guest type

Re: Dynamic Guest Assignment

balaji.bandi — Wed, 28 Feb 2024 20:11:20 GMT

that is possible based on the workflow you creating the approval option i guess. - check the guide (Using Guest_Flow to Match Guest User Type)

Re: Dynamic Guest Assignment

Arne Bier — Wed, 28 Feb 2024 21:59:44 GMT

@AhmedALJAWAD44875 Not possible -

@balaji.bandi I'd love to be proven wrong with a worked example, but there is no control over amending the Guest Type AFTER a self-registered guest account has been created in the ISE system. You can't even do it manually in the GUI anywhere.

Re: Dynamic Guest Assignment

balaji.bandi — Thu, 29 Feb 2024 09:42:51 GMT

@Arne Bier - thank you for correcting and clarifying that amending is the limitation, But for the the first time registration should be ok for the user to have daily or weekly or monthly right (as i remember when i tested) - i will check again and test it.

apologies for the confusion here.