01-23-2020 03:24 PM
Situation: Open SSID for Guests Sponsored Access. Either guests or Employees can authenticate on CWA.
Requirement: Once an AD:IT user is authenticated via CWA, customers wants MAC address of device be automatically added to RegisteredDevices. Goal: when the device reassociate with the Guest-Net, it will be automatically accepted on the Guest network without any further cwa. The customer doesn't want to use BYOD for its employees, and wants the AD:IT employees to remain on the Guest-Net.
Also, customer would like that, following CWA, if an AD:Employee is NOT from the IT group, then customer wants the MAC address to be put in Blacklist.
Summary: the customer wants that, for users authenticating via CWA and OU=IT, the MAC address be put in the RegisteredDevices, and that those devices when re-connecting to the Guest-Net, be automatically recognized without prompting the user for CWA, but only for users from OU=IT.
Thanks.
Solved! Go to Solution.
01-31-2020 08:28 PM
@cpaquet wrote:
Situation: Open SSID for Guests Sponsored Access. Either guests or Employees can authenticate on CWA.
Requirement: Once an AD:IT user is authenticated via CWA, customers wants MAC address of device be automatically added to RegisteredDevices. Goal: when the device reassociate with the Guest-Net, it will be automatically accepted on the Guest network without any further cwa. The customer doesn't want to use BYOD for its employees, and wants the AD:IT employees to remain on the Guest-Net.
Also, customer would like that, following CWA, if an AD:Employee is NOT from the IT group, then customer wants the MAC address to be put in Blacklist.
Summary: the customer wants that, for users authenticating via CWA and OU=IT, the MAC address be put in the RegisteredDevices, and that those devices when re-connecting to the Guest-Net, be automatically recognized without prompting the user for CWA, but only for users from OU=IT.
Thanks.
Check out special flows.
There is no way to choose on login which groups do what. however you can play with this. Look at the prescriptive guest guide for more details on some configurations . you can tweak around with this
You can however to do the following:
setup multiple endpoint groups for guest endpoints
allowedEndpoint
Denied endpoint
setup allowedhotspot portal mapped to allowedEndpoint
do similiar for denyportal
setup authorization flows
if mab and guestflow and adGroupAllowed then redirect to allowedHotspotPortal (device will be assigned correct group)
if mab and guestflow and deniedGroup ( or no groups) then redirect go denieDportal
if mab and GuestEndpoint group then permit access
if mab and deniedEndpoint then deny access
if mab then redirect to guest portal
01-31-2020 08:28 PM
@cpaquet wrote:
Situation: Open SSID for Guests Sponsored Access. Either guests or Employees can authenticate on CWA.
Requirement: Once an AD:IT user is authenticated via CWA, customers wants MAC address of device be automatically added to RegisteredDevices. Goal: when the device reassociate with the Guest-Net, it will be automatically accepted on the Guest network without any further cwa. The customer doesn't want to use BYOD for its employees, and wants the AD:IT employees to remain on the Guest-Net.
Also, customer would like that, following CWA, if an AD:Employee is NOT from the IT group, then customer wants the MAC address to be put in Blacklist.
Summary: the customer wants that, for users authenticating via CWA and OU=IT, the MAC address be put in the RegisteredDevices, and that those devices when re-connecting to the Guest-Net, be automatically recognized without prompting the user for CWA, but only for users from OU=IT.
Thanks.
Check out special flows.
There is no way to choose on login which groups do what. however you can play with this. Look at the prescriptive guest guide for more details on some configurations . you can tweak around with this
You can however to do the following:
setup multiple endpoint groups for guest endpoints
allowedEndpoint
Denied endpoint
setup allowedhotspot portal mapped to allowedEndpoint
do similiar for denyportal
setup authorization flows
if mab and guestflow and adGroupAllowed then redirect to allowedHotspotPortal (device will be assigned correct group)
if mab and guestflow and deniedGroup ( or no groups) then redirect go denieDportal
if mab and GuestEndpoint group then permit access
if mab and deniedEndpoint then deny access
if mab then redirect to guest portal
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide