two independent portal sponsors

[Victor Galvis]

Hello, I am trying to create two separate portal sponsors for two different locations, it is required that each administrator of the sponsor only have access to the users created from each of the sites, I have the problem that the two portal sponsors are created but all the users created from each headquarters, without separating, I would like to know if it is possible to create them completely independent, the administrator users of the sponsor are created internally in the ISE

[Francesco Molino · Accepted solution]

Hi

I'm over my phone and can't share any screenshot right now.
When you create the sponsor group profile, you can tell if sponsors are allowed to see all guests or guests created by all people member of the same group or their own guest only.
This means of you create 2 groups and configure that sponsors attached to it can see all group guests created you'll have 1 group per site and each sponsor of a site can see all guests attached to this sponsor group.

Is that clear? I'll be able to share a screenshot if needed.

[Jason Kunst · Accepted solution]

---

@Francesco Molino wrote:
Hi

I'm over my phone and can't share any screenshot right now.
When you create the sponsor group profile, you can tell if sponsors are allowed to see all guests or guests created by all people member of the same group or their own guest only.
This means of you create 2 groups and configure that sponsors attached to it can see all group guests created you'll have 1 group per site and each sponsor of a site can see all guests attached to this sponsor group.

Is that clear? I'll be able to share a screenshot if needed.

---

Very  nice :) keep in mind the built-in administrator access to the sponsor portal sees all accounts. Its not recommended to use this portal at all really. Its to go directly to the sponsor portal (using portal test URL or even better an easy URL FQDN based access)

Some links to read

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#concept_0C4E9B15B81B4FE0ACD61178815E4272

Sponsor portal

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/sponsor_guide/b_spons_SponsorPortlUserGuide_24/b_spons_SponsorPortlUserGuide_22_chapter_00.html#concept_8EFC1F4B42CC47BFB5D7F072125CCD26

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01111.html#id_35332

There are several ways to open a Sponsor portal:

• In the Administrators console, using the Manage Accounts link. On the Administrators console, click Guest Access, then click Manage Accounts. When you click Manage Accounts, you are assigned to the default sponsor group with access to ALL_ACCOUNTS. You can create new guest accounts, but those guests cannot be notified, since there is no email address available to receive the account activation request from the guest. A Sponsor with the same privileges who logs on to the sponsor portal, and searches for those accounts, can send notification.

  This step requires that the FQDN that you configured on the sponsor portal's Portal Behavior and Flow Settings page is in your DNS server.

  If you are accessing the Sponsor portal through a NAT firewall, the connection uses port 9002.

• In the Administrators console, on the Sponsor Portal configuration page. Click Guest Access > Portals & Components > Sponsor Portals, open a sponsor portal, and click the Portal Test URLlink to the right of the Description field.

• In a browser, by opening the URL (FQDN) configured in the sponsor portal's Portal Settings page, which must be defined in your DNS server.