ISE Wired Guest control

[manvik]

How do I implement Guest authentication for Wired devices using Cisco ISE. Requirement is to display Guest Portal for Non-AD joined devices.

If the system is AD joined Access should be permitted.

Only AD joined systems need to have access, if someone brings a new device/system and plugs in it should not get connected.

[balaji.bandi · Accepted solution]

That is the basic nature of ISE right, only authorised device will get in to Right VLAN, if not authenticated user will be default VLAN until they get authenticated.

Most use case on Wireless this will be redirect to Guest portal to get Authenticated.

Wired means we trusitng the devices who ever plug in - but looks you have other requirement. Can be possible with Profiles.

Reference :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_guest.html

https://ciscocustomer.lookbookhq.com/iseguidedjourney/BYOD-configuration?utm_campaign=ISE&utm_content=Guide&utm_source=Cisco.com-Open&utm_medium=ISE-Page-BYOD&pfhide=true

[manvik]

Thank you @balaji

You are right, requirement is a bit different. Not-AD joined wired systems need to get a Guest portal only.

In this scenario, should any config be done in Network switches.

Does anyone have any links to documents for this.

[balaji.bandi]

@mike beat me with the message - he provided all the information you need including videos

[Mike.Cifelli · Accepted solution]

Additional information:

ISE Secure Wired Access Prescriptive Deployment Guide - Cisco Community

ISE Guest Access Prescriptive Deployment Guide - Cisco Community

Video: Security | Lab Minutes

HTH!

[MHM Cisco World]

802.1x will failed OR timeout for Guest 
then SW will give VLAN to Guest, Guest will get IP and if it try to connect to Web it will redirect to ISE for WebAuth.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216330-ise-self-registered-guest-portal-configu.html

[manvik]

Thank you @balaji @mike

Those docs were helpful. It seems ISE Easyconnect would be an ideal solution, but few points on easyconnect;

Does easyconnect works with any network switches other than Cisco

How can ISE easyconnect track a cache login of AD user. Cache logins are not reflected in AD login audit logs.

[balaji.bandi]

ISE is Identiy - So you can use ISE Log as audit Logs, i am sure it get data from your AD.

[hslai]

> Does easyconnect works with any network switches other than Cisco

It might but our teams validated only Cisco catalyst switches.

> How can ISE easyconnect track a cache login of AD user. Cache logins are not reflected in AD login audit logs.

No. But, the WMI providers start with the last 1-hour historical events. EasyConnect works with WMI providers only today.