Write Guest Portal Information into an Endpoint Identity Group

[christian.faessler]

Hi folks,

In the portal builder for the 'Self-Registered Guest Portal' under BYOD Settings is an option to 'allow employees to use personal devices on the network' and just below that, an Endpoint Identity Group can be chosen (see attached pic). Can someone explain, what this setting is used for?

Is it possible to write the 'guest user information' from the selfregistration portal into an Endpoint Identity Group?

Thans for any feedback.

Christian

[Mike.Cifelli · Accepted solution]

FYSA there are some really good resources here: Cisco ISE & NAC Resources - Cisco Community

Is it possible to write the 'guest user information' from the selfregistration portal into an Endpoint Identity Group?

-Yes, those settings are defining how the registered endpoint will get added in an ISE identity group, and the purge rule declares when ISE will automagically purge registered endpoints from the group.  For example, you could setup purging to ensure that certain BYOD devices are only allowed on the network in a given window (5 days, etc.).  The identity group you decide to use can then be referenced in authz policies so that you can steer these types of devices into the respective network and add restrictions etc.  HTH!

[christian.faessler]

Hi Mike

Thanks for your reply. After thorough testing and with your input I finally understand how the mechanism works.

One question keeps me busy. I would like to keep the MAC address of the registered devices for a longer period than the guest user account is valid.

Background: We want the clients to be registered for one year but the user account should only be valid for 1 week because no one will remember the password for a year. Do you have a solution for this situation?

Cheers, Christian

[Greg Gibbs · Accepted solution]

Guest endpoints are deleted as part of the default Endpoint Purge Policy found at Administration > Identity Management > Settings Endpoint Purge.

You can modify the policy to purge the endpoints after 365 days.