Guest Access Services

What it is

Guest access gives visitors and contractors limited, time bound network access without giving them company credentials.

ISE provides the portals, the guest accounts, the rules for how long an account lasts, and the policy that limits what a guest can reach. Guests are kept apart from internal users by their own identity store and their own authorization result.

How it works

You define the guest types and portals, then write the policy that redirects and later authorises the guest.

Guest types

A guest type is a template for an account. It sets how long the account stays valid and the rules for how the guest signs in. Common examples are contractor, daily and weekly guests.

The sponsor group decides which guest types a sponsor may create. Guest types are managed in the Guest Access work center in the ISE portal. You build one type for each kind of visitor, so the rules stay easy to follow.

Guest flows

ISE offers three main guest flows. Each one has its own portal type.

The hotspot flow is the lightest. It suits a cafe or lobby where you only need the guest to agree to the terms. The self registered flow gives more control, and the sponsored flow gives the most.

The guest identity store

Guest accounts live in a separate internal store. ISE puts them in a guest identity group. Policy can use that group to recognise a guest.

Expiry is handled by ISE. When the account reaches its end time, ISE disables it and removes it later, according to the purge settings. The guest then cannot log in again with that account.

The access policy

A guest flow uses central web authentication, which you met on the previous page. The policy has the same two steps.

1. A first rule matches an unknown guest on MAB, and returns the redirect to the guest portal.
2. A second rule matches a guest who has signed in, and returns the limited access.

The second rule often uses the guest flow condition or the guest identity group. It sets a VLAN, a downloadable ACL, or a security group tag. The aim is internet only access, or access to a small set of services.

Switch(config)# ip http server
Switch(config)# ip http secure-server
Switch(config)# aaa server radius dynamic-author
Switch(config-locsvr)# client 10.1.1.11 server-key SECRET

Wireless guest design

Most guest access is wireless. A common design is a separate guest SSID. The WLAN uses MAC filtering and web redirection, with ISE as the RADIUS server.

In many networks the guest traffic is tunnelled to a controller in a DMZ, called an anchor controller. This keeps guest traffic away from the internal network. The foreign controller handles the radio side, and the anchor puts the guest onto the DMZ network.

Notifying the guest

For self registered and sponsored accounts, the credentials have to be delivered to the guest. ISE can show them on the page, print them, or send them by email or text message.

Text messages need an SMS gateway to be configured. Email needs an SMTP server in the ISE settings.

Verify

On ISE, open Operations, RADIUS, Live Logs. A guest that works shows a first authentication with a redirect and a second one with the final result. In the guest work center, the reports list the guest accounts and their login activity.