cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1403
Views
0
Helpful
1
Replies
daan.celie
Beginner

Cisco ISE visitor/employee portal

Hello community

 

We're about to fully redesign our guest portal. Currently we have 2 SSIDs, one is for visitors which redirects them to a sponsor-based registration portal. A second SSID is for employees to "register" their BYOD devices and uses very simple MAB. Helpdesk currently manually adds the MAC addresses in ACS after which the employee can login on the WIFI with their personal phone. As most employees are not technically-savvy it's often a hurdle to obtain the MAC address of their device.

 

The idea for the new setup is to combine these 2 SSIDs into one. When a visitor/employee connects to this SSID they first receive a web page on which they must choose between Employee or Visitor. Depending on what they're clicking, they need to receive the correct registration form. For employees a registration form that asks them for their name and company ID, for visitors just a classic registration form (name, company, host, duration of stay, etc.) .

 

I've seen this kind of setup with ISE in another company, but am clueless how it was setup. Maybe they used a simple web server for providing the first page. I'm not sure whether this functionality is integrated in ISE. How do I proceed with this?

 

Thank you

1 ACCEPTED SOLUTION

Accepted Solutions
Mohammed al Baqari
VIP Advisor

Hi,

You can do the following:

1. Single SSID for both visitors and employees.
2. When they connect to the SSID, they will get redirected to guest portal
3. It will ask to login or create an account if you don't have one
4. Visitors should login with their x-days account if they already created
one or create new account
5. Employees can login using their AD accounts (you can enable this option
in Guest Portal configuration by allowing BYOD in guest portal and assign
endpoint group)
6. Employees will complete the enrollment steps by entering the
Name/Description and finish the process.
7. Once the process is completed, the MAC address should be already
assigned to endpoint group listed in step 5. This is done automatically.
8. You should have an authorization rule above your guest portal rule which
should match the endpoint group in step 5 and allow access (whatever DACL
you assign).


***** please remember to rate useful posts

View solution in original post

1 REPLY 1
Mohammed al Baqari
VIP Advisor

Hi,

You can do the following:

1. Single SSID for both visitors and employees.
2. When they connect to the SSID, they will get redirected to guest portal
3. It will ask to login or create an account if you don't have one
4. Visitors should login with their x-days account if they already created
one or create new account
5. Employees can login using their AD accounts (you can enable this option
in Guest Portal configuration by allowing BYOD in guest portal and assign
endpoint group)
6. Employees will complete the enrollment steps by entering the
Name/Description and finish the process.
7. Once the process is completed, the MAC address should be already
assigned to endpoint group listed in step 5. This is done automatically.
8. You should have an authorization rule above your guest portal rule which
should match the endpoint group in step 5 and allow access (whatever DACL
you assign).


***** please remember to rate useful posts

View solution in original post

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel