When using the Self-Register Guest Portal, I was wondering if anyone had the issue where corporate users were connecting to the Guest Wifi with domain computers, which would cause their endpoint to be statically re-mapped to the guest group. Then when they try to get back on the corporate Wifi, they may not be able to connect back because their device is now statically set as a Guest device. I am trying to set this up and am running into this... I didn't want corporate assets to be classified as Guest devices if a users hops onto the guest network. Thanks!! Attached a screenshot of a corporate asset that jumped on the guest Wifi and was mapped to the Guest Devices.       ... View more

Is it possible to do downlink macsec without the full NDAC/SGA setup?   I am trying to set up encryption from the PC's to the switchport and it is attempting, but never completes. I keep getting these two logs: (I have researched these logs but couldn't really find anything that worked) (It gets a little confusing when MACSec/NDAC and SGA are all explained at the same time in some of the documents and in the official Cisco Press book!) %MKA-4-KEEPALIVE_TIMEOUT: Peer has stopped sending MKPDUs for RxSCI....  %MKA-4-SESSION_UNSECURED: MKA Session was stopped by MKA and not secured for RxSCI.....      This is my related interface config: interface GigabitEthernetX/Y/Z  switchport access vlan XYZ  switchport mode access  switchport voice vlan XYZ  ip access-group PREAUTH in  authentication event fail action next-method  authentication event server dead action authorize vlan 712  authentication event server dead action authorize voice  authentication event server alive action reinitialize    authentication host-mode multi-domain  authentication order dot1x mab  authentication priority dot1x mab  authentication port-control auto  authentication violation restrict  macsec  mka default-policy  mab  dot1x pae authenticator  dot1x timeout tx-period 10  spanning-tree portfast   - Attached a picture of related ISE and Anyconnect Config   Thank You for any advice or input!!  :) ... View more

Would anyone know if there is there a way to add users that are in the sponsor portal to a user identity group so you can write authoization rules for them? What I am trying to do is, for vendors, sponsor them an account and make that account available on both wired and wireless. I can do this if I create a 'Network Access User' within ISE, but then the user has to be manually deleted, it would be slick if I could call out accounts that are created from sponsoring someone. (These accounts would have a time period and can be sponsored by employees rather than me having to log in ISE and create each account from the admin node) Thanks a bunch!! ... View more