ISE 1.3 Guest account Activate

[pemasirid]

Hi,

Has anyone worked with ISE 1.3 with creating guest accounts using sponsor portal.?.

Our issue is that whenever we create new guest account using sponsor portal the account is shown as "Created" not as "Active". When we try to use the same account in guest portal it gives authentication failed and shows as "account is not yet active" in ISE report. (please see the attached file)

Can anyone tell how to make new account active or why it shown as "created" not as "active"?

thanks in advance.

[Seb Rupik]

Hi there,

I am having the exact same problem with my ISE 1.3 deployment after upgrading from 1.2 to 1.3 .

The issue seems to relate to timezones (as a lot of ISE problems do!) .

The issue relates to settings under Guest Access -> Settings ->Guest Locations and SSID . You should have defined a location local to you, for me it is 'Southampton, Europe/ London', the San Jose entry cannot be removed.

There should be an option to select timezone in the Sponsor Portal but it is missing so defaults to 'San Jose'. This causes a time-zone mis-match between between the account itself and the SSID location.

However if you create a guest account using the admin GUI: Guest Access -> Manage Accounts, although you still cannot select the timezone it will choose the correct one for the SSID and you will then be able to use the account via the Guest Portal. I don't know what would happen if you had a second SSID and alternative location, it would probably be totally broken!

I have raised this issue with TAC three weeks ago, and had a webex with the Business Unit last week. They saw the issue and took some debug logs, all very helpful people, but the problem is still unresolved.

cheers,

Seb.

[pemasirid]

Hello Seb,

Thanks for your response. Infact you gave me really good hints and it make sense.

Let me check if I can change the time zone and also try creating guest accounts through Admin and see it can find some workaround and update you if it works.

However I would really appreciate if you can let me know what TAC will find about this issue.

Regards,

Pemasiri

[pemasirid]

Hello Sab,

Yes, you are right, even though we add timezone and location as per our region, it does not allow to select while creating users and its gets the San Jose as always and it can not be even delete.

I would really appreciate if you can update me what TAC find the solurtion for this issue.

Thanks and regards,

Pemasiri

[Seb Rupik]

Hi Pemasiri,

Good to hear that the root cause is consistent.

I'll update this post once I hear from TAC.

cheers,

Seb.

[pemasirid]

Hi Seb,

Thanks for your reply and I look forward to hear from you soon with some resolutions.

Meanwhile if I get something I'll keep you posted.

Regards,

Pemasiri

[Seb Rupik]

Hi Pemasiri,

I have a bug ID: CSCut18028   ...it is yet to be released on cisco.com.

If you have TAC support for your ISE install I strongly suggest you raise a case and mention this bugID to escalate the issue within the BU.

cheers,

Seb.

[Patrick Meyer · Accepted solution]

Hi,

as a workaround, one can change the timezone-preset of San Jose. To do so, go to Guest Access -> Settings -> Guest Locations and SSIDs, select the San Jose entry, click on Edit and in the upper-right drop down choose the Timezone you need. Then click on replace to replace the existing San Jose timezone to the one you need. I just confirmed with a customer that this is working. Not a nice solution though. I have attached a screenshot with the changed timezone

[pemasirid]

Hi Patrick,

Thanks for your reply, yes it was resolved with your given workaround and we will wait for next patch/release to fix that.. :) 

Thanks again for your response and it was really helpful and appreciated.

Regards,

Pemasiri

[Patrick Meyer]

I am glad that it was of help. Next time I am at our lab want to check whether changing the default timezone for sponsors have any impact on the self serviced portals. But chances are high that 1.4 will be released prior to me testing this.

[andypenning]

Thanks for the workaround!

[pemasirid]

Hi Seb,

Thanks for sharing these information. I was temporary fixed by editing the San Jose timezone with our region timezone and then users we created were active once they used at 1st login.

We will wait for the next patch/release to fix it.. :)

Thanks a lot for your all response and time on this.

cheers

Pemasiri

[Seb Rupik]

I've just had confirmation that this will be fixed in 1.4; to be release in April.

[y.lo]

We had the exact same issue with ISE 1.3. It is about the San Jose timezone setting.

When you create the guest accounts with San Jose timezone, the valid time range of the accounts has not started yet. So you got error message "account is not yet active"

You can try creating the guest accounts with the earliest start time you can specify. Then you should be able to login with the guest account.

I just wanted to create a TAC case about this, but as above reply said that there is still no solution from TAC I will wait and see.