Cisco wise connection

[Brenno]

Hi everyone, hope you're doing well!

I'm currently reviewing a solution that involves a captive portal for Wi-Fi authentication, and I’d really appreciate your input.

Does Cisco ISE support the following scenario?

"The web authentication portal should allow customization and support integration with authentication servers like AD, LDAP, and also a national single sign-on (SSO) platform that uses credentials such as a national ID and password. If direct integration isn't possible, alternative solutions that do not add extra cost to the overall system would be acceptable."

Specifically:

Can the ISE web portal be customized to this level?

Does ISE support integration with AD, LDAP, and SSO platforms using OAuth2/OIDC?

If not directly, is it possible to integrate a third-party access gateway or portal alongside ISE without needing additional paid modules?

Thanks a lot in advance for any guidance or experience you can share!

[Enes Simnica]

hello @Brenno Yes, Cisco ISE does support a high level of customization for web authentication portals, including branding, layout, and input fields. And absolutely u can design the captive portal to match national SSO branding or workflows, within certain limits.

Integration capabilities:

• AD & LDAP: Fully supported out-of-the-box.
• SSO using SAML is supported. However, OAuth2/OIDC is not natively supported for web authentication flows in ISE as of now.

If ur national SSO platform uses OAuth2/OIDC, direct integration with ISE’s captive portal won’t work. But u can place a third-party access gateway in front of ISE to handle SSO and then forward RADIUS accounting or CoA to ISE for policy enforcement. And its good to know that this doesn’t require additional ISE licenses, as long as u stay within Base/Plus tier features. Just avoid using features like pxGrid or profiling if u're trying to keep costs down.

check these links also: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_guest.html 

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html 

hope the answer is not that long LOOOOOOL, good luck and hope it helps

-Enes

[Brenno]

Thanks @Enes Simnica, your answer helped me, but can you tell me some documentation that prove it? 

[Enes Simnica]

good day to u @Brenno and glad it helped. Yes i do have some links that i believe will back up what i mentioned;

• Web Portal customization and guest access in ise: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_guest.html
• SAML sso support in ise: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217342-configure-ise-3-1-ise-gui-admin-login-fl.html
• Third-Party Integration using External Web Auth & RADIUS: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html

AND I FOUND THIS POST FROM @Jason Kunst which looks SICK!!! : https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475#toc-hId--1992631054 

hope it helps and peace!

-Enes

[MHM Cisco World]

Can I know your requirements' forget what ISE support.

Maybe we can solve it by know excatly what your requirements.

You have user need to access network 

This user must get portal write some info before access?

MHM

[MHM Cisco World]

You need

Wlc ISE 

Run self register guest portal

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216330-ise-self-registered-guest-portal-configu.html

MHM