Guest and Self-Register wireless configuration on ISE

[atsukane]

HI all,

Our guest WiFi setting is on the default policy set along with other unused policies, so I'm planning on creating new set for wifi.

At the same time, I plan to spin up another WLAN for employees with AD authentication (e.g. SSID Staff), and enable self-registering on the existing guest WLAN (e.g. SSID Guest).

Trying to get head round to it but confused how to achieve this.

I'm guessing I need two authorization profiles for both SSIDs with web redirection pointing to  either self-register or guest URL, then under a single Policy Set a series of Authorization Polices are configured to push the to relevant profile so that devices are sent to the right URL?

Sorry, it's very vague but am I on the right track?

Any suggestion is very much appreciated.

Thanks,

[howon · Accepted solution]

I suggest creating a separate policy set for 'SSID Staff'. You can leave the guest in the default policy set or can create a policy set for 'SSID Guest'. Having separate policy set will make the policy much easier to change and understand in the future. See example policy set here: https://community.cisco.com/t5/security-documents/tips-for-new-ise-administrators/ta-p/3891856#toc-hId--570604833

[atsukane]

Thanks　@howon 

Noted the below tip from the link

Creating first policy set

Best policy is one that is easy to read. Don’t put all policy rules into single or default policy set, it will make the policy conditions complex and hard to read. Use following table as template and customize it for your environment.

Thanks again.