Separation between Sponsor and Guest Portal

[martucci]

Hello,

I have a customer who is looking to implement sponsored access for the guests, with an anchor controller in the DMZ.

They would like to though to have full separation of access for the guest portal and sponsor portal, not having them on the same box, but on different PSN.

I am wondering if there is any pest practice or you know any customer that had the same request.

Thanks

[hslai]

Both sponsor and guest portals are part of ISE guest services and currently there is no option to separate them on different ISE nodes.

I would suggest to configure a different TCP port for ISE sponsor portal and, if needed, a different interface, from those for ISE guest portal. Then, use firewall or ACL to differentiate their accesses.

[martucci]

Thanks,

Customer IT security doesn't want to share box, so double interface or different ports would not work.

Was suggested to engineer separation blocking access to sponsors portal on the PSN in which they will redirect the guests, and viceversa, but I was looking for alternatives

Sent from my iPhone

[Jason Kunst]

Isn't it possible to have another psn with separate interface and port running sponsor port only and then guest running on another psn?

This way even though sponsor and guest services are still running on same box they can be firewalled and access on different boxes?

[martucci]

Hi Jason,

I am not sure I follow you, I guess both PSn would have both portals, but you mean to allow only PSN1 for example to be accessed over the Sponsor portal (block sponsor portal on PSN2) and then block Guest access on PSN1, but direct and allow only guests from PSN 2 correct?

Thanks was my idea, just looking to see if there was something else possible

[Jason Kunst]

Yes that should work

[hslai · Accepted solution]

This one might have some potentials is to separate them to two deployments -- Guest-Deployment (G) and Sponsor-Deployment (S) -- and then have G to use S as RADIUS token server to authenticate guest users, instead of using G's internal guest users.

[martucci]

Thanks Hsing,

This is the solution I think that this will do for them.

Thanks

Francesca