ISE - Number of users per guest user account

[Mikael Gustafsson]

Hi

Is ther a way to limt the allowed number of sessions per user account on the guest access?

As of now I can log in with more then one device using the same credentials.

Thanks

  Mikael

[Tarik Admani]

Muhammad,

This subject of this thread is for guest access on the network and not admin access to ISE to view reports. That is interesting that you brought this up, can you provide some documentation so i can provide that to my customers that might run into this behavior.

Thanks,

Tarik Admani
*Please rate helpful posts*

[Saurav Lodh]

Multiple session with same credential means user will login via different device not same device multiple login If you login in fb via different sessions and all active @ same time, you do that via different i-browsers or machines. Therefore aim is to not allowing the user to use multiple devices to login with his/her username. The same can be achievable here.

You  can restrict guests to having only one device connected to the network  at a time. When guests attempt to connect with a second device, the  currently-connected device is automatically disconnected from the  network.

This is a global setting affecting all Guest portals.

---

Step 1 Choose Administration > Web Portal Management > Settings > Guest > Portal Policy.

Step 2 Check the Allow only one guest session per user option.

Step 3 Click Save.

Hope the above helps you

[hermodfinjord]

Saurav Lodh wrote:
Multiple session with same credential means user will login via different device not same device multiple login  If you login in fb via different sessions and all active @ same time, you do that via different i-browsers or machines. Therefore aim is to not allowing the user to use multiple devices to login with his/her username. The same can be achievable here.
You  can restrict guests to having only one device connected to the network  at a time. When guests attempt to connect with a second device, the  currently-connected device is automatically disconnected from the  network. 
This is a global setting affecting all Guest portals. 
Step 1 Choose Administration > Web Portal Management > Settings > Guest > Portal Policy.
Step 2 Check the Allow only one guest session per user option. 
Step 3 Click Save. 
Hope the above helps you

Thanks!

I have already completed the three steps you have listed above but the limiting feature is not working. I have checked the "Allow only one guest session per user" and it is no problem connecting with two or three devices with the same guest user.

I guess im doing something wrong, but i dont know what it is...

Is there a solution for this?

[Mohan Devarajan]

Hi Experts,

Do we have option for user to limit the session (2 session per user), in ISE 1.2 please advise.  

Thnx,

Mohan

[danimax01]

Thanks

"Therefore aim is to not allowing the user to use multiple devices to  login with his/her username. The same can be achievable here"

we want to achieve this for employee not guest. How will we go about it.

To prevent this type of scenario.

User A authenticate on Computer 1 with his credential

User A authenticate on Computer 2 with his credential

User A authenticate on Computer 3 with his credential

and all of them are all online at the same time.

We want to prevent this situation

[kaaftab]

    Yes you can configure it in the portal policy

[blenka]

I hope there is no such limit for the guest users but yes it can be managed by time, days & other.

Cisco ISE administrators and employees that are granted appropriate access to the Cisco ISE guest

registration portal as guest sponsors can create temporary guest login accounts and specify available

network resources to allow guests, visitors, contractors, consultants, and customers to access the

network. Guest access sessions have expiration timers associated with them, so they are effective in

controlling guest access to a specific day, time period, and so forth.

All aspects of a guest user session (including account creation and termination) are tracked and recorded

in Cisco ISE so that you can provide audit information and troubleshoot session access, as necessary.

[Shaoqin Li]

in 1.2 you can enable single session per user... when second login occurs, previous login will be terminated.

Sent from Cisco Technical Support iPhone App

[hermodfinjord]

I am using ISE1.2 and I have checked the Allow only one guest session per user option in the guest portal settings. I can still connect to my guest WLAN with multiple devices with the same guestaccount at the same time.

Is checking the Allow only one guest session per user the only thing i have to do to get this to work or do i have to apply any special rules or something?

[ipagliani]

Ciao,

are you using LWA or CWA ?

I open a case and engineer respond me that it's a feature supported only in CWA. The WLC need to undestand CoA send by ISE to disconnect the first guest connected.

Any feedback?

[hermodfinjord]

Thanks for input :-)

Im using CWA and a virtual WLC.

[mstraessle]

Did anybody find a solution for this problem? I ran into the same issue with CWA and ISE 1.2 (Patch 5 ) and WiSM2 (7.5.x).

[jesus torres galiano]

Hi folks, I'm running ISE 1.2.1 with patch level 2.

Radius clients are WLC 's running 7.6.130.0

I use CWA

I'm having the same issue: I check "Allow only one guest session per user" but I am still able to connect from several devices using the same guest credentials

I'm about to install Patch 3 - Hope that helps