INTEGRATING CISCO ISE GUEST AUTHENTICATION WITH PAN-OS

[craiglebutt]

Hi

I've been playing around with this for a while, and now got it working.

Have a slight issue.

When a new guest joins, for example Bob Builder, ISE gives him account of Bbuilder, he connects through a sponsored portal, changes his password ext, starts to surf, the traffic is then captured on the Palo Alto, with the Bbuilder.

Bob stops using his device.  Them 40 mins later start using it again, but he is still connected to the wlan, not prompted to enter username.  But when he surfs now, he username is no longer showing up in source name on the palo alto.

Any ideas on how to get him to authenticate again or keep passing the details though.  Is there a session timer some where on the ISE that needs changing?

cheers

[Jason Kunst · Accepted solution]

Craig I assume you’re basing access of the guest remember functionally described here? And using syslog sent to PAN from ISE? likely you will need to run ise 2.4


https://community.cisco.com/t5/security-documents/ise-2-3-remember-me-guest-using-guest-endpoint-group-logging/ta-p/3641150

[craiglebutt]

HI

Cheers for quick response, currently on 2.2, scheduling upgrade 2.4 In Jan

cheers

[Jason Kunst]

So is my assumption correct? You’re using syslog and running into this issue?

Also for now the would need to remove the remember me if they want tracking every time

Basic non remember me credentialed flow in the guest deployment guide


https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475