topic Re: Encryption ISE Guest Portal in Wireless

Encryption ISE Guest Portal

mgollob — Wed, 29 Mar 2023 11:52:30 GMT

I am currently implementing a PoC for an ISE guest solution. I got the question from the clients if it is possible to secure the SSID additionally with a PSK, so that the traffic from client to AP is encrypted as well.

Do you know if this works? Or is the traffic encrypted after a successful login anyway and only the first time to the guest portal is not encrypted? The WLC has Flex Connect configured.

Re: Encryption ISE Guest Portal

Karsten Iwen — Wed, 29 Mar 2023 12:18:01 GMT

The usage of the ISE guest portal is completely independent of your choice of WLAN security. Yes, you can enable PSK security if you want. This security is used throughout the user session, before and after the authentication on the guest portal. Only the assigned authorisation (VLAN, ACL, SGT) can change if you want.

Re: Encryption ISE Guest Portal

mgollob — Wed, 29 Mar 2023 12:23:57 GMT

After successful login to the guest portal, is the traffic then end-to-end encrypted if I do not activate PSK? Can anyone tell me this?

Re: Encryption ISE Guest Portal

mgollob — Wed, 29 Mar 2023 12:24:22 GMT

After successful login to the guest portal, is the traffic then end-to-end encrypted if I do not activate PSK? Can anyone tell me this?

Re: Encryption ISE Guest Portal

Karsten Iwen — Wed, 29 Mar 2023 12:34:20 GMT

I you don't have security like PSK on the WLAN, the link between the Client and the AP is unencrypted. The traffic from the Client to the ISE is always HTTPS and encrypted. The rest of the user traffic is whatever it is, encrypted or unencrypted. The WLAN-Security only defines the link between client and AP.

Re: Encryption ISE Guest Portal

Scott Fella — Wed, 29 Mar 2023 15:21:27 GMT

Sometimes overdoing it makes the user experience really bad. If you take a look at your guest users, do you think they want to have to connect to a guest network that they need to enter a crazy psk and then go through a portal page? If you have users that are young, they might not mimd, but older folks will not want to do that because it's a pain in their a$$. Best way is to test that out, have some non technical customer employees try to access the guest and get feedback. I remember when we were deploying guest and the business wanted the users to have the best experience and even navigating through the portal with a mobile phone was not welcomed. They decided to just have an open SSID and the feedback from guest users was exactly what they wanted. The process was easy and fast.

Re: Encryption ISE Guest Portal

mgollob — Thu, 30 Mar 2023 05:26:22 GMT

Thank you for the comment. I completely agree with you on this, but the decision on how to implement it lies with someone else. At the presentation I will have to say what is possible and what I would recommend. How the decision will turn out, I can't say yet 🙂