How to secure a Sponsor Portal from unauthorized access

[NightLight]

Hello all,
I have set up a demo lab and am trying to learn how best to secure ISE. Now I am wondering how to secure the access to the Sponsor Portal.

I use interface 0 I for management. Interface 2 and 3 I have bundled for the data. If I would manage the portal myself now, everything would be ok. In most companies, however, I know that you always get vouchers for the guest WLAN via the reception. That means the reception would have to get access rights to the PAN or PSN node to reach the portal.
Is there a way to outsource the portal to its own interface?

Best regards

[Sri Harsha Dasari]

You can have all the users who creates accounts in an AD group, then have restricted access to that AD group. You can customize on which menu users can see and what functions they can do under Administration -- System -- Admin Access -- Authorization(Here create a specific Policy for a group).
Now Under Administrators -- Admin Groups -- Pick the policy you created and add the AD group to this policy

[Octavian Szolga · Accepted solution]

Hi NightLight,

The sponsor portal itself is not on PAN, but rather on PSN. It's a different portal than the admin (GUI) portal.

Secondly, it listens on a specific port and has to have a specific FQDN.
The FQDN is basically what tell ISE that instead of going to https://sponsor.mycompany.com (443) you want to actually go to the webserver hosted on port 8443 (as an example; default sponsor portal port) that is used solely for sponsor portal.

You can 'secure' this portal:

- by allowing reception personnel to contact ISE PSN only on 8443 (you have to check if FQDN:8443 connection method works or ISE PSN needs to initially receive the request on 443 and redirect it afterwards to 8443)

- by using a load balancer and some WAF services in order to inspect web traffic going to this portal

BR,
Octavian