AD Group controlled access to BYOD self-reg portal (ISE 2.4)

[darryldigsit]

What is the recommendation if a customer wants to limit access to the self-reg BYOD portal based on AD Groups?  i.e. staff and contractors get access to self register devices, but no one else can access the portal....

[paul]

You have to use the RADIUS callback trick documented on the forums.  Basically setup ISE as a RADIUS server to itself which allows the flow to come into a normal policy set where you can apply AD restrictions.

[Jason Kunst · Accepted solution]

Are you trying to limit access to the My Devices Portal? Then use this document as Paul mentioned
https://community.cisco.com/t5/security-documents/ise-1-3-2-1-sponsor-authorization-on-secondary-attributes/ta-p/3641379

Otherwise if you’re trying to determine what groups have to go through BYOD flow for native supplicant and certificate provisioning then you can do the following:

This will allow guests and certain non byod required direct to internet otherwise force them to go through BYOD
Authz rules:


* If TLS auth valid cert then permit access
* If mab and guestflow and BYODrequiredgroup (AD employee, contractor) then redirect to NSP (byod portal)
* If mab and guestflow then permit access
* OR if mab and guest endpointgroup then permit access


* If mab then redirect to guest portal (CWA)