What is the difference "Guest access" and "BYOD" in ISE?

[JustTakeTheFirstStep]

I feel similar between "Guest access" and "BYOD" in ISE.

Both are authenticated through the web portal and authorized to the network.

I'd like to know what the difference is.

[marce1000 · Accepted solution]

 - Check this thread : https://community.cisco.com/t5/network-access-control/byod-vs-guest-services-in-ise/td-p/3079419

 M.

[Nancy Saini · Accepted solution]

By default, the self-registrered guest portal is used for guest and BYOD. If the user logs in with corporate credentials it goes through client provisioning which is the BYOD flow. If the user enters the guest credentials that it would go through the guest flow.

[JustTakeTheFirstStep]

I understand

Can you give me the source URL of the image?

[Nancy Saini]

The image is from ISE self-registered guest portal (Work Centers > Guest Access > Portals & Components > Guest Portals > Self-registered guest portal). If you enable BYOD settings on the portal, you will see BYOD flow as well.

[thomas · Accepted solution]

BYOD == Bring Your Own Device == "Employee personal endpoints".  BYOD policy can vary greatly from organization to organization. Some only want to know "it's my employee's device" while others want to provisioning identity certificates for authentication, and others may want to install MDM applications for greater management and risk avoidance in exchange for more network privileges and "greater productivity" using any device the employee chooses.

Guest == "Non-employee Internet only" although some organizations treat employee personal endpoints as Guest endpoints, too.

In ISE, the BYOD flow authenticates against your users with an organization's identity store and then determines if it should be merely registered or provisioned with a certificate or MDM. Guest goes through a portal for Hotspot, Self-Registered, or Sponsored access, depending on what you require.

[JustTakeTheFirstStep]

@thomas @Nancy Saini @marce1000 

I'm trying to test BYOD on ISE.

We want to collect information from BYOD users and onboard them at ISE.
device type,
device OS,
name,
department,
IP, MAC

I have a few questions.

1. Is NSP Agent installation mandatory on laptops and mobile devices? Is it possible with agentless?

2. What is the algorithm that gives different rights to each user when the user authenticates himself without the sponsor's approval process?

For example
AAA user is full privileges to the profile A.
BBB user is limited privileges to the profile B.

Is the above process possible in the BYOD portal without sponsor involvement?

[thomas]

See https://cs.co/ise-byod and read Cisco ISE BYOD Prescriptive Deployment Guide .

Start new threads with new questions.