Cisco ISE visitor/employee portal

[daan.celie]

Hello community

We're about to fully redesign our guest portal. Currently we have 2 SSIDs, one is for visitors which redirects them to a sponsor-based registration portal. A second SSID is for employees to "register" their BYOD devices and uses very simple MAB. Helpdesk currently manually adds the MAC addresses in ACS after which the employee can login on the WIFI with their personal phone. As most employees are not technically-savvy it's often a hurdle to obtain the MAC address of their device.

The idea for the new setup is to combine these 2 SSIDs into one. When a visitor/employee connects to this SSID they first receive a web page on which they must choose between Employee or Visitor. Depending on what they're clicking, they need to receive the correct registration form. For employees a registration form that asks them for their name and company ID, for visitors just a classic registration form (name, company, host, duration of stay, etc.) .

I've seen this kind of setup with ISE in another company, but am clueless how it was setup. Maybe they used a simple web server for providing the first page. I'm not sure whether this functionality is integrated in ISE. How do I proceed with this?

Thank you

[Mohammed al Baqari · Accepted solution]

Hi,

You can do the following:

1. Single SSID for both visitors and employees.
2. When they connect to the SSID, they will get redirected to guest portal
3. It will ask to login or create an account if you don't have one
4. Visitors should login with their x-days account if they already created
one or create new account
5. Employees can login using their AD accounts (you can enable this option
in Guest Portal configuration by allowing BYOD in guest portal and assign
endpoint group)
6. Employees will complete the enrollment steps by entering the
Name/Description and finish the process.
7. Once the process is completed, the MAC address should be already
assigned to endpoint group listed in step 5. This is done automatically.
8. You should have an authorization rule above your guest portal rule which
should match the endpoint group in step 5 and allow access (whatever DACL
you assign).


***** please remember to rate useful posts