ISE Guest & Web Authentication

[thomas]

Shortened to cs.co/ise-guest

• Features
• ISE 2.3
• ISE 2.1/2.2
• Demos
• Blogs
• Configuration
• Remember Me
• Guest Migration
• Web Portal Access via SAML SSO
• Integrations
• Meraki
• Envoy
• Palo Alto Networks
• Miscellaneous
• Notifications (SMS/E-mail)
• Special Flows
• Customizations
• General customizations
• Guest
• Credential Login Page
• Self-Registration
• Sponsor Portal
• Create Known accounts Page
• Manage Accounts Page
• Approvals
• Logging/Monitoring/Syslog
• APIs
• Local Web Authentication (LWA)

Features

ISE Guest Wireless Feature Comparison

ISE 2.3

• 
  
  • YouTube Demo & Config Info

ISE 2.1/2.2

• ISE 2.2 Single Click Sponsor Approval FAQ
• ISE 2.1 & 2.2 Guest Enhancements PDF - overview

Demos

• ISE Guest Demo - Hotspot Self-Registration and Sponsor portal usage [ short - long ]

Blogs

• ISE Guest Types do i really need locations and timezones?

Configuration

• ISE Guest Access Prescriptive Deployment Guide - utilizes ISE 2.3 with WLC 8.5 code
• Cisco ISE Secure Access Wizard (SAW) - Guest, BYOD and Secure Access in Minutes! - for 2.2+ releases
• How To: ISE Web Portal Customization Options
• How to Configure & Use a Facebook Social Media Login on ISE
• Hotspot and Self-Registering Guest Setup (ISE 2.2) — Networking fun [Video]
• How To: ISE 2.0 Wireless Guest Setup Guide- for releases prior to 2.2
• ISE Wireless Guest Setup Guide & Wizard - for releases prior to 2.2, recommendation is to use ISE 2.2+ for new setups using the secure access wizard
• H3C WX HPE Wireless with Cisco ISE Guest
• Sponsor Portal User Guide for Cisco Identity Services Engine, Release 2.0
• ISE Version 1.3+ Self Registered Guest Portal Configuration Example
• ISE Guest Accounts for RADIUS/802.1x Authentication Configuration Example - using guest accounts with wired/wireless dot1x (no web auth required)
• ISE Sponsor and MyDevices Auth Based on Secondary Attributes - 1.2 had this built in for Sponsors; here are workarounds for use with ISE 1.3+
• ISE and Location-Based Web Authentication Portals - examples on how to redirect to different portal depending on NAD locations
• Central Web Authentication with FlexConnect APs on a WLC with ISE Configuration Example
• Configuring Cisco Mobility Express AP with ISE
• Central Web Authentication on Converged Access and Unified Access WLCs Configuration Example
• ISE with Static Redirect for Isolated Guest Networks Configuration Example
• Re: ISE CWA Using Non-Management Interface
• Guest & BYOD Device Registration only (no supplicant or certificate provisioning)
• CoA Terminate in Hotspot portal is not initiating DHCP refresh (WIRED)
• Can we use different interface(non-management interface) on ISE for web-logon portal
• How to get a portal's URL for LWA use cases
• Solution for Change of VLAN for wired Guests using Smart Port Macros

Remember Me

• Employee CWA (guest portal) flow with remember me
• ISE 2.3+ Remember Me guest using guest endpoint group logging display

Guest Migration

• Moving from other Guest database systems to ISE

Web Portal Access via SAML SSO

• ISE 1.4 SAML SSO Web Auth Oracle Access Manager Config Notes
• Google Suite Guest SSO (Single Sign On) with ISE via SAML for Chromebooks
• Notes on Okta as SAML IdP
• Notes on Azure AD as SAML IdP
• Re: ISE SAML with Google IdP
• ISE 2.1 with PingFederate
  
  • Configure ISE 2.1 Guest Portal with PingFederate SAML SSO - Cisco
  • Configure ISE 2.1 Sponsor Portal with PingFederate SAML SSO - Cisco
  • Lab Config Guide: ISE 2.1 with Ping Fed for Guest Web Auth & Sponsor Portal SAML SSO

Integrations

Meraki

• Meraki and ISE [Video]
• How To: Integrate Meraki Networks with ISE

Envoy

• Cisco Envoy Visitor Management with ISE guest API
• https://help.envoy.com/cisco-ise-integration integration guide

Palo Alto Networks

• Integrating Cisco ISE Guest Authentication with PAN-OS - Live Community

Miscellaneous

• Apple iDevices and OSX Machines Do Not Display ISE or WLC Redirect Page Problem Resolution - WLC Captive Portal Bypass
• Java Update Enforces CRL Checks by Default Which Prevents NSP and Guest Flows
• Re: Prevent ISE from consuming a license on an open SSID
• Preventing endpoints who join guest network to get access to corporate network
• Keeping company-owned devices from joining guest SSID
• Periodic AUP Acceptance - less than 8 hours?
• SSID usage in ISE policy in sponsor portal
• ISE - Restricting Employee assets from accessing Guest SSID
• How to restrict access to guest portal or encrypt guest traffic
• ISE Guest CWA and HTTPS redirection
• ISE 2.x Sponsor Portal Health Check URL clarified

 

Notifications (SMS/E-mail)

General

• ISE Guest SMS Notification General Information
  • provides general provider support (tidbits) and troubleshooting
• Configure ISE Version 1.4 Email and SMS Notifications

Providers

• ISE Guest SMS Support using Twilio Provider
• ISE Guest SMS for clickatell provider

• ISE Guest SMS Support for MMF Solutions Provider using Dynamic Variable Timestamp
• ISE Guest SMS Support for Sendquick Provider
• ISE Guest Password Integration with SMS Gateway Based on Postfix and Kannel Configuration Example (using mail to SMS gateway)

Special Flows

• Credentialed and hotspot access from a single portal - utilizes a single portal to allow access to allow users to register, login with credentials or utilize a short flow like a hotspot
• Hotspot and BYOD on a single portal flow - this flow allows a single page to serve a hotspot user and employees using a BYOD flow, an alternate of linking one portal to another 
• Configure ISE Guest Short Time Hotspot Access then Require Registration - Cisco - Gives guest option to first get quick access (15 min in this example) then user is required to do self-registration flow (captures info)
• ISE Guest Web Auth Portal with Get Quick Access (Hotspot) button - Make a single portal that allows credentialed and/or quick access using embedded credentials as a hotspot button
• Guest Hotspot choose a group login from list 
• Guest Flow where different types of users have different endpoint purging requirements - Guests register devices for 1 day, employees 1 week and executives for 365 days (for example)
• How to limit guest access to 1 hour within a 24 hour period
• Guest Hotspot with max 2 hours network access per day
• Guest portal: How to restrict employee access to only specific AD group?
• Re: ISE map CWA AD group to Endpoint Group

Customizations

ISE Portal Builder - create customized portals (guest, byod, mdm, posture) using drag & drop editor

ISE Portal Builder Customization Modifications - make changes to the portal builder with javascript not included in the tool.

Support for 1.3+

• I have a script that shows me how to hide an element on a page but I want to also hide something else, how do i find it?
  • This video shows you in an example on the sponsor portal page

General customizations

• ISE Portal General Customization (Global)
• How to center ISE content in a frame.
• ISE Web Portals providing a different logo per language
• Guest Page insert image with hyperlink
• ISE Portal Customization - working with backgrounds
• ISE Portal Support Page MAC Address as a QR Code

Guest

• How To: ISE Web Portal Customization Options
• Single Credential Login to Guest Portal (same password used for all accounts and hiding field) - Used for guest scenario where they only want a 6 number passcode (not a username + password)
• Hotspot as a Message Portal with Support link - redirect user to a meaningful message portal when being redirected due to quarantine or blacklist (only 1 blacklist portal allowed)
• Login page auto-redirect to create an account page - This script is used for providing guests direct access to self-registration page.
  • For a kiosk that might be in a lobby
  • guest flow is usually going to create an account first (and not needing the login page)
  • Meraki LWA where they want to link customer directly to self-reg portal from the splash page
• ISE Guest registration (create account) and login on same page
• Hotspot Portal with information collection
  • Makes a self-reg portal into a hotspot flow that allows you to collect information (such as email address)
  • Re: Ise guest self registration page checkbox requirement for newsletter
• Captcha type protection for self-reg and login pages - i am not a computer, human interaction
• Linking one guest portal to another guest portal (ability to choose another portal)
• ISE Hotspot portal with links to employee or vendor portals
• ISE Guest Portal Multi-language override (choose your language)
• ISE Credentialed guest Portal hide username in login box

Credential Login Page

• ISE Guest Portal Customization - Don't have an account moving and sizing

Self-Registration

• ISE Guest Self-Registration Portal Basic Customization Options
• ISE Guest Self-Registration person being visited (sponsor) choose list or assign
• ISE Guest Self-Registration form working with phone numbers
• ISE Guest Self-Registration phone number as the username
• ISE Guest Self-Registration restrict/validate the person being visited email address
• ISE Guest Social Media Login Tweaks
• ISE Guest Self-registration Portal Customization - newsletter signup checkbox
• Guest Self-Registration with access to e-mail to get credentials before complete sign-on

 

Sponsor Portal

• ISE Sponsor Portal Customization - General

Create Known accounts Page

• ISE Sponsor Portal Customization - Create Known Accounts Page
• Sponsor Portal Known Guest Account - select Email automatically on notify

Manage Accounts Page

• ISE Sponsor Portal Customization - Manage Accounts Page
• Sponsor Portal - change/hide options on "Resend" Email
• ISE custom sponsor portal using API to filter pending accounts requiring approval to the person being visited
• How to hide buttons on the sponsor portal
• ISE Sponsor Portal manage accounts page customization for GDPR compliance privacy (hide fields)
• ISE Sponsor Portal auto location based off sponsor machine time
• ISE Sponsor - how to un-check End of business day during account creation
• Restrict sponsors from creating guest accounts

Approvals

• ISE Guest Sponsor Portal Customization - hide email for ApproveButton Pop-up message

Logging/Monitoring/Syslog

• Syslog generation for Guest network
• logging guest self registration
• NAC appliance similar configuration also see Cisco Live - BRKEWN-2014

APIs

• ISE Guest Sponsor API Tips & Tricks
• ISE API for working with portal settings and elements
• Purge Endpoint Group Using API

Local Web Authentication (LWA)

• Identity Services Engine Guest Portal Local Web Authentication Configuration Example