Reg:Comparision of Anchor Controller and ISE

[Mohamed Kabeer S]

Hi Team,

Good Day.

In my company,We are using cisco 5508 Wireless controller with three SSID.

1.Radius authentication,

2.Pres hared Key and

3.Guest Access

For guest access, we have configured the Traffic only access internet.Rest of them we blocked by ACL. The traffic should not access any lan subnet.

In my company we are planned to implement ISE or anchor controller,because everytime Guest try to find IT peoples to get username and password for guest access. We don't want guest everything comes to it.

If any guest want to connect internet means, once they connected my Guest SSID, they will get one splash page and they need to type self information and whomever he or she need to me,they need type my internal employe email id. Once they filled all the information and they need click submit the detail. After that my internal employee will receive the mail and he will review and approve the request.

once my internal employee approved the guest user will get the SMS with username and password.

Kindly advise me which one is best to implement the same.

Thanks in advance for your support and understand.

Regards,

Kabeer

[RockstarWiFi · Accepted solution]

Kabeer,

Let me try and help if I understand correctly. First it sounds like you already have a guest network and is using some type of ACL's on the WLC, or upstream somewhere to segregate traffic and you have QoS and or rate-limiting in place for guest traffic. Sounds like you are wanting to have guest users perform self-provisioning where they request access which get's forwarded to a "Sponsor" the sponsor approves the access, and account is confirmed with details being forwarded to the guest in an automated format (e-mail or SMS)?

If that's the case and your comparing getting a guest anchor controller or ISE to do this, than were talking about two separate things. ISE is definitely what you want for ANY Type of self-provisioning as the WLC is limited to splash page, splash page with re-direct, splash page requiring a user submit their e-mail address (just to prove it's a user really and not someones XBOX, or Guest Authentication. But the WLC only scenario, you must manually provision these guest accounts one way or another even with a Guest Anchor. Guest anchor is simply a term used to describe a WLC that is statically defined as the "Anchor controller" which terminates (distributes) all guest traffic and is typically positioned in the DMZ, but still offers the same features as other controllers, more of a role than anything.

One of the many features of ISE is Guest User self-provisioning as described above and seems to be what your looking for:)

Hopefully this help's, if I am not understanding you correctly please let me know.

~ please rate all helpful post~

[Mohamed Kabeer S]

Hi Chris,

Thank you very much for your reply.

Now I can understand clearly.

Regards,

Kabeer