Cisco Ise 13 User Guide

1InISE,chooseWorkCenters>GuestAccess>Portals&Components>SponsorPortals,andedityour
sponsorportal.
2SelectthePortalPageCustomizationtab.
3ScrolldownandselectCreateAccountforKnownGuests.
•OnthePreviewdisplayontheright,selectSettings.
Thesesettingsdeterminewhichfieldsdisplayandarerequiredforguestaccountswhentheyarecreated
onthesponsorportal.
ThisconfigurationappliestoKnown,Random,andImportedguesttypes.Thetemplatethatthesponsor...

Procedure
Step 1ChooseOperations>Reports.
Step 2UndertheReportSelector,expandtheGuestAccessReportsandEndpointsandUsersselectionstoview
thevariousguest,sponsor,andendpointrelatedreports.
Step 3SelectthereportandchoosethedatawithwhichyouwanttosearchusingtheFiltersdrop-downlist.
Youcanusefiltersonusername,portalname,devicename,endpointidentitygroupandothersuchdata.
Step 4SelecttheTimeRangeduringwhichyouwanttoviewthedata.
Step 5ClickRun.
Metrics Dashboard...

◦InspectHTTPtrafficandsenddatatoCiscoISEMonitoringnode.CiscoISErequiresonlytheIP
addressandaccessedURLfortheGuestActivityreport;so,limitthedatatoincludejustthis
information,ifpossible.
◦SendsyslogstoCiscoISEMonitoringnode.
Sponsor Login and Audit Report
TheSponsorLoginandAuditreportisacombinedreportthattracks:
•LoginactivitybythesponsorsattheSponsorportal.
•Guest-relatedoperationsperformedbythesponsorsintheSponsorportal.
ThisreportisavailableatOperations>Reports>GuestAccessReports>SponsorLoginandAudit....

NAD with Central WebAuth Process
Inthisscenario,thenetworkaccessdevice(NAD)makesanewauthorizationrequesttotheCiscoISERADIUS
serverfromanunknownendpointconnection.Theendpointthenreceivesaurl-redirecttoCiscoISE.
webauth-vrf-awarecommandissupportedonlyinIOSXE3.7E,IOS15.2(4)Eorlaterversions.Other
switchesdonotsupportWebAuthURLredirectinvirtualroutingandforwarding(VRF)environment.In
suchcases,asaworkaround,youcanaddarouteintheglobalroutingtabletoleakthetrafficbackinto
theVRF.
Note...

•Ifitisapostureflow,wheretheGuestportalisconfiguredtoperformclientprovisioning,theguest
devicewebbrowserdisplaystheClientProvisioningpageforpostureagentinstallationand
compliance.(Youcanalsooptionallyconfiguretheclientprovisioningresourcepolicytofeaturea
“NetworkAccess:UseCase=GuestFlow”condition.)
BecausethereisnoclientprovisioningorpostureagentforLinux,theGuestportalredirectstotheClient
Provisioningportal,whichinturnredirectsbacktoaguestauthenticationservlettoperformoptionalIP
release/renewandthenCoA....

areWLC5760andCiscoCatalyst3850,3650,2000,3000,and4000SeriesAccessSwitchesrunningreleases
IOS-XE3.6.0.Eand15.2(2)E.
Figure 22: WLC with Local WebAuth Non-Posture Flow
Wired NAD with Local WebAuth Process
Inthisscenario,theGuestportalredirectstheguestloginrequesttotheswitch(wiredNAD).Theloginrequest
isintheformofanHTTPSURLpostedtotheswitchandcontainsthelogincredentials.Theswitchreceives
theguestloginrequestandauthenticatestheguestusingtheconfiguredCiscoISERADIUSserver....

IP Address and Port Values Required for the Login.html Page
TheIPaddressandportvaluesmustbechangedinthefollowingHTMLcodeforthelogin.htmlpagetothose
valuesbeingusedbytheCiscoISEPolicyServicesnodes.Thedefaultportis8443,butyoucanchangethis
value,soensurethatthevalueyouassigntotheswitchmatchesthesettinginCiscoISE.
ISEGuestPortal


Redirecting...LoginISEGuestPortal

Becausethecustomloginpageisapublicwebform,considertheseguidelines:...

Procedure
Step 1Tospecifytheuseofyourcustomauthenticationproxywebpages,firststoreyourcustomHTMLfileson
theswitchflashmemory.TocopyyourHTMLfilestotheswitchflashmemory,runthefollowingcommand
ontheswitch:
copytftp/ftpflash
Step 2AftercopyingyourHTMLfilestotheswitch,performthefollowingcommandsinglobalconfigurationmode:
Specifiesthelocationintheswitchmemory
filesystemofthecustomHTMLfiletouse
inplaceofthedefaultloginpage.The
device:isflashmemory.
ipadmissionproxyhttploginpagefile
device:login-filename
a....

Device Registration WebAuth Process
UsingDeviceRegistrationWebAuthentication(DeviceRegistrationWebAuth)andtheHotspotGuestportal,
youcanallowguestdevicestoconnecttoaprivatenetworkwithoutrequiringusernamesandpasswords.
Inthisscenario,theguestconnectstothenetworkwithawirelessconnection.SeeFigure23:WirelessDevice
RegistrationWebAuthenticationFlowforanexampleoftheDeviceRegistrationWebAuthprocessflow.
ThefollowingisanoutlineofthesubsequentDeviceRegistrationWebAuthprocess,whichissimilarforboth...

isenabled,theguestisrequestedtomanuallyrenewtheirIPaddress.Formobiledeviceusers,werecommend
usingAccessControlLists(ACLs)ontheWLC,ratherthanusingVLANs.
Figure 23: Wireless Device Registration Web Authentication Flow
   Cisco Identity Services Engine Administrator Guide, Release 1.3
334
Guest Access Web Authentication Options