ISE Guest wifi sponsor setting issue

[jack lee]

We got an issue about our Cisco ISE. One of our colleague reported that his account cannot show the full list of the manage account in the sponsor page. I’ve checked the account status, and there is no issue regarding our configuration. Please refer to the capture below attachment. As the capture showed, my account is in group ACB Sponsor, but only two user showed in the “manage accounts” list. Furthermore, one of the user type is VCIC_Guest_Workdays and it should not be showed here. The capture also showed that the Guest type “ACB_Guest_Workdays” can be managed by the sponsor, which should be correct. The information of our ISE showed below:version 2.3.098 patch 2

[ajc]

To make it simple, only the Sponsor Group mapped to an specific AD Group with the following setup can see ALL the Guest Accounts in the DB no matter the profile for each one (i.e duration).

[ajc]

My AD account that belongs to the AD Group mapped to the Sponsor Group = NetworkAdmin, can see all the 800 guest accounts in the DB

*****IMPORTANT*****, The Sponsor Group rules are checked SEQUENTIALLY (top to bottom) when you are accessing the internal Guest DB using "manage account option" or "sponsor portal". That means if your AD Account belongs to another SponsorGroup/AD Group policy in the sequence with lower privileges then you can get the result you saw.

[jack lee]

Thank you very much!

[ajc]

On my case, my AD Account does NOT belong to the initial 2 AD Groups/AD Groups link. That is why, when I access the "manage account", I am hitting the 3rd Sponsor Group "policy" (NetworkAdmin) which is mapped to the AD Group I belong to so I can get access to the whole Guest DB.

If your AD Account belongs from example to the "VISITOR" Sponsor Group (policy) which has lower privileges, then you would see only 2 Guest accounts from the DB.

[ajc]

Information sent by email as requested.