Sponsor and Guest Portals

What it is

Portals are the web pages that ISE shows to guests and to the sponsors who create guest accounts.

The guest portal is what the visitor sees. The sponsor portal is what an employee uses to create, manage and approve guest accounts. Both are hosted on the Policy Service Nodes.

How it works

Each portal has a type, settings for the flow, a certificate, and a look that you can customise.

Guest portal types

There are three guest portal types, matching the three flows.

You create and edit portals in the Guest Access work center, under Portals and Components. ISE provides a default portal of each type that you can change or copy.

Portal settings

Each portal has a page for its settings, and a page for each step of the flow. The settings cover items such as the portal certificate group, the identity source sequence, the language and the acceptable use policy.

The portal test option lets you open the portal from the admin screen. Use it to check the look before you send real users to it.

For the self registered portal, you set the fields in the registration form, the guest type that applies, and whether approval is required. If approval is on, the sponsor receives a request and chooses to approve or deny.

Portal ports and addresses

The portals run on the PSNs on their own web ports. The guest portal uses TCP 8443 by default, and the sponsor portal uses TCP 8445. The port can be changed in the portal settings.

The redirect sends the guest to the FQDN of a PSN. That name has to resolve in DNS for the guest, or the page does not load.

You can instead set a custom FQDN for the portal. Guests then see a friendly address, such as a name under your company domain.

Certificates

A portal is served over HTTPS, so it needs a certificate that has the portal usage. This is set on the system certificate in ISE, under Administration, System, Certificates.

The certificate should contain the portal FQDN, in the subject alternative name. If the guest device does not trust the signer, the browser shows a warning. A certificate from a public authority avoids this for devices you do not manage.

You can use a certificate group tag to link portals to a certificate. Several portals can share one tag. A wildcard certificate can be used for portals when its name matches the FQDN.

Sponsor groups

A sponsor group says what a sponsor may do. It defines which guest types the sponsor can create, how many guests, and whether they can see accounts made by others.

ISE has default sponsor groups for three levels of access:

• All accounts: The sponsor sees and manages every guest account.
• Group accounts: The sponsor manages accounts created by members of the same group.
• Own accounts: The sponsor manages only the accounts they created.

Sponsors are allowed in by identity. You map a sponsor group to members, such as directory groups, so that only the right staff can use the sponsor portal. A sponsor signs in with their normal company credentials, and the identity source is set in the sponsor portal.

Sponsor portal functions

A sponsor can create one guest or import many from a file. They can extend an account, suspend it, delete it, or resend the credentials. They can also approve self registered requests.

Customisation

You can change the logos, colours, text and the language of the pages. The acceptable use policy text is kept in the portal. You can show it, require acceptance, or both.

Keep the guest pages short. A guest on a phone should be able to complete the flow in a few taps.

Verify

ise-psn/admin# show application status ise

Use the command to confirm that the application services are running on the PSN. Then test the portal from a client. In the live logs, a portal login shows the portal name and the guest identity.