Short duration guest accounts

[Simon94995]

Hi experts,

I have been looking at implement ISE guest wireless with short account life times, ideally 2 hours, based on self-registered portal.

To achieve this, I would need to use NetworkAccess:Usecase GuestFlow in the authorization rules for such short time periods, because when using GuestEndpoints identity group and relaying on endpoint purge, the purge job would only run once a day at night, which means the endpoint would stay in the GuestEndpoints for the whole day and the guest endpoint would have Internet access for much longer than two hours.

Just wanted to check if this logic is correct and if there is maybe another way how to achieve this with GuestEndpoints identity group? (which provides better user experience, as users don't need to log on to the network more than once).

Thank you

[paul · Accepted solution]

You don't rely solely on the identity group in your rules for this and you don't need the guest flow condition at all for guest setups.  You have a couple things you need to do to make this work:

1. On the WLAN definition on the wireless controller you need to set your session timeout to 2 hours.  So all guests will get kicked off and have to reauthenticate.  Optionally if you don't want to set this for all guests you could set a reauthentication timer for the short term guest result in ISE.
2. Craft your rules for guest policy set in ISE to look something like this:
   1. If MAC address is in identity group long term guest allow Internet access.
   2. If MAC Address is in identity group short term guest and AUP acceptance is less than 2 hours ago allow Internet access.  In this authorization profile you could set the 2 hour session timeout.
   3. Redirect to guest portl
3. Make sure your guest portal has AUP acceptance enabled for every login not just on first login.

[Simon94995]

Thanks very much for the suggestion, this worked nicely.

It would be great if there was an option just to purge the associated guest endpoint from GuestEndpoints group automatically when the self-registered guest account expires.