Cisco Ise 13 User Guide

							◦Viewmessagesin—SpecifythelanguagetousewhendisplayingemailorSMSnotificationsas
yousetthemup.
◦Email—Sendaccountexpirationnoticesbyemail.
◦Usecustomizationfrom—Applythesamecustomizationsthatyouconfiguredfortheselected
portaltothisGuestType'saccountexpirationemails.
◦Copytextfrom—ReuseemailtextthatyoucreatedforanotherGuestType'saccountexpiration
email.
◦Sendtestemailtomeat
◦SMS—SendaccountexpirationnoticesbySMS.
ThesettingsthatfollowforSMSarethesameasforemailnotifications,exceptthatyouchoose
anSMSgatewayforSendtestSMStome.
•SponsorGroups—Specifythesponsorgroupswhosememberscancreateaguestaccountusingthis
guesttype.Deletethesponsorgroupsthatyoudonotwanttohaveaccesstothisguesttype.
What to Do Next
•Createormodifysponsorgroupstousethisguesttype.Formoreinformation,seeSponsorGroups,on
page317.
•Ifappropriate,assignthisguesttypetoself-registeringguestsintheSelf-RegisteredGuestportal.For
moreinformation,seeCreateaSelf-RegisteredGuestPortal,onpage312.
Disable a Guest Type
Youcannotdeletethelastremainingguesttypeorguesttypesthatarebeingusedbyguestaccounts.Ifyou
wanttodeleteaguesttypethatisinuse,firstensurethatitisnolongeravailableforuse.Disablingaguest
typedoesnotaffectguestaccountsthatwerecreatedwiththatguesttype.
Thefollowingstepsexplainhowtoprepareforanddisableatargetguesttype.
Procedure
Step 1Identifythesponsorgroupsthatallowthesponsortocreateguestsusingthetargetguesttype.ChooseGuest
AccessConfigureSponsorGroups,andopeneachsponsorgroupandexaminetheThissponsorgroupcan
createaccountsusingtheseguesttypeslist.
Step 2IdentifytheSelf-Registeredportalsthatassignthetargetguesttype.ChooseGuestAccess>Configure>
GuestPortals.OpeneachSelf-RegisteredGuestportal.Iftheportalisusingthespecificguesttype,expand
PortalSettings,andchangetheassignedguesttypeinthefieldEmployeesusingthisportalasguestsinherit
loginoptionsfrom:.
Step 3Opentheguesttypeyouwishtodelete,anddeleteallsponsorgroupsthatyouidentifiedintheprevioussteps.
Thisactioneffectivelypreventsallsponsorsfromusingcreatinganewguestaccountwiththisguesttype.
ChooseGuestAccess>Configure>GuestType.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
295
Guest and Sponsor Accounts 
						

							That'sit.Youcan'tactuallydeletetheguesttype.Makesureyoudon'tuseinanyportalsinthefuture.
Changing Guest Account Attributes
Whenaguestaccountiscreated,attributesareconfiguredforthataccountbytheGuestType.
IfyoueditanexistingGuestTypetochangethetimeperiodorotherattributes,thenewattributeswillnotbe
appliedtoexistingguestaccounts.
TochangetheattributesofanexistingGuestaccount,createanewGuesttypewithnewattributes,andapply
thatGuestTypetoanexistingaccount.ThataccountwilltakeonalltheattributesofthenewGuestType,
includingdefaultaccesstimes,datesandduration.Inaddition,thecustomfieldsfromtheoriginalGuestType
arecopiedtothenewGuestaccount,evenifthecustomfieldisblank.
ASponsorcanalsoextendtheaccountdurationbeforethetimeperiodhasexpired.
Schedule When to Purge Expired Guest Accounts
Whenanactiveorsuspendedguestaccountreachestheendofitsaccountduration(asdefinedbythesponsor
whencreatingtheaccount),theaccountexpires.Whenguestaccountsexpire,theaffectedguestscannotaccess
thenetwork.Sponsorscanextendexpiredaccountsbeforetheyarepurged.However,afteranaccountis
purged,sponsorsmustcreatenewaccounts.
Whenexpiredguestaccountsarepurged,theassociatedendpointsandreportingandlogginginformationare
retained.
CiscoISEautomaticallypurgesexpiredguestaccountsevery15days,bydefault.TheDateofnextpurge
indicateswhenthenextpurgewilloccur.Youcanalso:
•ScheduleapurgetooccureveryXdays.ThefirstpurgewilloccurinXdaysatTimeofPurge,then
purgesoccureveryXdays.
•ScheduleapurgeonagivendayoftheweekeveryXweeks.ThefirstpurgeoccursonthenextDayof
WeekatTimeofPurge,thenpurgesoccureveryconfigurednumberofweeksonthatdayandtime.
Forexample,onMondayyousetpurgestooccuronThursdayevery5weeks.Thenextpurgewillbe
theThursdayofthisweek,nottheThursday5weeksfromnow.
•ForceapurgetohappenimmediatelybyclickingPurgeNow.
IftheCiscoISEserverisdownwhenthepurgeisscheduledtorun,thepurgeisnotexecuted.Thepurge
processwillrunagainatthenextscheduledpurgetime,assumingtheserverisoperationalatthattime.
Procedure
Step 1ChooseGuestAccess>Settings>GuestAccountPurgePolicy.
Step 2Chooseoneoftheseoptions:
•ClickPurgeNowtoimmediatelypurgetheexpiredguestaccountrecords.
•CheckSchedulepurgeofexpiredguestaccountstoscheduleapurge.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
296
Guest and Sponsor Accounts 
						

							Aftereachpurgeiscompleted,theDateofnextpurgeisresettothenextscheduledpurge.Note
Step 3Specifyafterhowmanydaysofinactivitytopurgeuser-specificportalrecordsmaintainedintheCiscoISE
databaseforLDAPandActiveDirectoryusers.
Step 4ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast
savedvalues.
Add Custom Fields for Guest Account Creation
Whenprovidingguestaccess,youmaywanttocollectinformationfromyourguestsbeyondjusttheirnames,
emailaddresses,andphonenumbers.CiscoISEprovidescustomfieldsthatyoucanusetocollectadditional
informationaboutgueststhatisspecifictoyourcompany’sneeds.Youcanassociatethecustomfieldswith
guesttypesandwiththeSelf-RegisteredGuestandSponsorportals.CiscoISEdoesnotprovideanydefault
customfields.
Procedure
Step 1Toadd,edit,ordeletecustomfieldsforallGuestandSponsorportals,chooseGuestAccess>Settings>
CustomFields.
Step 2EntertheCustomFieldName,pickaDataTypefromthedrop-downlist,andenterTipTexttohelpprovide
additionalinformationaboutthecustomfield.Forinstance,ifyouenterDateofBirth,pickDate-MDY,and
enteratipforthedateformatasMM/DD/YYYY.
Step 3ClickAdd.
Thecustomfieldappearsinthelistinalphabeticalorderorinthecontextofthesortedorder.
Step 4ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast
savedvalues.
Ifyoudeleteacustomfield,itwillnolongerbeavailableforselectionintheCustomFieldslistfor
guesttypesandintheSelf-RegisteredGuestandSponsorportalssettings.Ifthefieldisbeingused,
Deletewillbedisabled.
Note
What to Do Next
Youcanincludethedesiredcustomfields:
•Whendefiningaguesttypesothataccountscreatedwiththatguesttypewillincludethisinformation.
SeeCreateorEditaGuestType,onpage293.
•WhenconfiguringtheSponsorportalforsponsorstousewhencreatingguestaccounts.See#unique_537.
•Whenrequestinginformationfromself-registeringguestsusingaSelf-RegisteredGuestportal.See
CreateaSelf-RegisteredGuestPortal,onpage312.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
297
Guest and Sponsor Accounts 
						

							Specify Email Addresses and SMTP Servers for Email Notifications
CiscoISEallowsyoutosendemailstosponsorsandguests,notifyingthemofinformationandinstructions.
YoucanconfigureSMTPserverstodelivertheseemailnotifications.Youcanalsospecifytheemailaddress
fromwhichthenotificationswillbesenttoguests.
Procedure
Step 1TospecifyemailsettingsandconfigureSMTPserversforallGuestandSponsorportals,chooseGuestAccess
>Settings>GuestEmailSettings.
Step 2Enableemailnotificationstoguestsischeckedbydefault.Ifyoudisablethissetting,guestswillnotreceive
emailnotificationsregardlessofanyothersettingsyoumayhaveenabledwhileconfiguringGuestandSponsor
portals.
Step 3EntertheDefault“From”emailaddressthatisdesignatedforsendingemailnotificationstoguests.For
example,[email protected].
Step 4Dooneofthefollowing:
•CheckSendnotificationsfromsponsor'semailaddress(ifsponsored)ifyouwantgueststoreceive
notificationsfromthesponsorwhocreatedtheiraccounts.Self-registeringguestswillreceivenotifications
fromthedefaultemailaddress.
•CheckAlwayssendnotificationsfromthedefaultemailaddressifyouwantgueststoreceive
notifications,regardlessofwhethertheyaresponsoredandself-registering.
Step 5ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast
savedvalues.
Assign Guest Locations and SSIDs
AGuestLocationdefinesanameforatimezone,andisusedbyISEtoenforcetime-relatedsettingsoflogged
onGuests.GuestLocationsareassignedtoGuestaccountsbySponsorscreatingaGuestaccount,andby
self-registeringGuests.ThedefaultGuestLocationisSanJose.IfnootherGuestLocationsareadded,all
accountsareassignedthisGuestLocation.Youcan'tdeletetheSanJoseGuestLocationunlessyoucreate
oneormorenewLocations.UnlessallyourGuestswillbeinthesametime-zoneasSanJose,createatleast
oneGuestLocationwiththerequiredtime-zone.
GuestaccesstimesarebasedontheGuestLocation'stimezone.AGuestusermaynotbeabletologinif
theGuestLocation'stimezonedoesn'tmatchthesystemtimezone.Inthiscase,theGuestusermayget
an"AuthenticationFailed"error.Youmightseethe"Guestactivetimeperiodnotyetstarted"errormessage
inthedebugreport.Asaworkaround,youcanadjusttheGuestaccessstarttimetomatchthelocaltime
zoneoftheGuestuserbyusingtheManageAccountsoption.
Note
TheSSIDsyouaddhereareavailabletoSponsorPortals,soSponsorscantelltheGuestwhichSSIDtoconnect
to.
Youcan'tdeleteaGuestLocationoraSSIDifitisconfiguredinaSponsorportalorassignedtoaGuest
account.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
298
Guest and Sponsor Accounts 
						

							Procedure
Step 1Toadd,editordeleteGuestLocationsandSSIDsforGuestandSponsorportals,chooseGuestAccess>
Settings>GuestLocationsandSSIDs.
Step 2ForGuestLocations:
a)Foreachtime-zonethatyouneedtosupport,enteraLocationnameandpickaTimezonefromthe
drop-downlist.
b)ClickAdd.
InaGuestLocation,thenameoftheplace,thenameofthetimezone,andtheGMToffsetare
static;youcannotchangethem.TheGMToffsetdoesnotchangewithdaylightsavingstime
changes.TheGMToffsetsaretheoppositeofwhatisshowninthelist.Forexample,Etc/GMT+3
isactuallyGMT-3.
Note
Step 3ForGuestSSIDs:
a)EntertheSSIDnamesofthenetworksthatwillbeavailableforgueststouseattheGuestLocations.
b)ClickAdd.
Step 4ClickSave.Toreverttothelastsavedvalues,clickReset.
What to Do Next
IfyouaddedanewGuestLocationorSSID,youcan:
•ProvidetheSSIDsforSponsorstousewhencreatingGuestaccounts.SeePortalSettingsforSponsor
Portals,onpage787.
•AddtheGuestLocationstoSponsorGroups,soSponsorsassignedtothatgroupcanusethemwhen
creatingguestaccounts.SeeConfigureSponsorGroups,onpage318.
•AssigntheGuestLocationsavailabletoself-registeringguestsusingaSelf-RegisteredGuestportal.See
CreateaSelf-RegisteredGuestPortal,onpage312.
•Forexistingguestaccounts,editthemmanuallytoaddSSIDsorLocations.
Rules for Guest Password Policies
CiscoISEhasthefollowingbuilt-inrulesforguestpasswords:
•TheGuestpasswordpolicyappliestosponsorportals,selfregisteredportals,accountsuploadedina
CSVfile,passwordscreatedusingtheERSAPI,andusercreatedpasswords.
•Changestotheguestpasswordpolicydonotaffectexistingaccounts,untiltheguestspasswordshave
expiredandneedtobechanged.
•Passwordsarecasesensitive.
•Thespecialcharacters,/,and%cannotbeused.
•Minimumlengthandminimumrequiredcharactersapplytoallpasswords.
•Passwordscannotmatchusernames.
•Newpasswordscannotmatchcurrentpasswords.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
299
Guest and Sponsor Accounts 
						

							•Guestsdonotreceivenotificationspriortopasswordexpiration,unlikeguestaccountexpiration.When
guestpasswordsexpire,eithersponsorscanresetthepasswordtoarandompasswordorguestscanlog
inusingtheircurrentlogincredentialsandthenchangetheirpassword.
Theguestdefaultusernameisfouralpabeticandpasswordisfournumericcharacters.Short,easyto
rememberusernamesandpasswordsareadequateforshort-termguests.Youcanchangetheusername
andpasswordlengthinISE,ifyoudesire.
Note
Set the Guest Password Policy and Expiration
YoucandefineapasswordpolicyforallGuestportals.AGuestpasswordpolicydetermineshowthepassword
isgeneratedforallguestaccounts.Apasswordcanbeamixtureofalphabetic,numeric,orspecialcharacters.
Youcanalsosetthenumberofdaysafterwhichguestpasswordswillexpire,requiringgueststoresettheir
passwords.
TheGuestpasswordpolicyappliestosponsorportals,selfregisteredportals,accountsuploadedinaCSV
file,passwordscreatedusingtheERSAPI,andusercreatedpasswords.
Procedure
Step 1ChooseGuestAccess>Settings>GuestPasswordPolicy.
Step 2EntertheMinimumpasswordlength(incharacters)fortheguestpasswords.
Step 3Specifythecharactersfromeachcharactersetthatcanbeusedbygueststocreatepasswords.
ChooseoneofthefollowingoptionsunderAllowedCharactersandMinimumstospecifythepassword
policyforguests:
•Useallthecharactersfromeachcharacterset.
•Topreventtheuseofcertaincharacters,chooseCustomfromthedrop-downmenu,anddeletethese
charactersfromthepredefinedandcompletesets.
Step 4Entertheminimumnumberofcharacterstousefromeachset.
ThetotalnumberofrequiredcharactersacrossthefourcharactersetsshouldnotexceedtheoverallMinimum
passwordlength.
Step 5ChooseoneofthefollowingoptionsunderPasswordExpiration:
•Specifythefrequency(indays)whenguestshavetochangetheirpasswordsaftertheyfirstlogin.Ifthe
guestsdonotresettheirpasswordsbeforetheyexpire,thenexttimetheylogintothenetworkusing
theiroriginallogincredentials,theyarepromptedtochangetheirpasswords.
•Setthepasswordstoneverexpire.
Step 6ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast
savedvalues.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
300
Guest and Sponsor Accounts 
						

							What to Do Next
Youshouldcustomizetheerrormessagesthatarerelatedtothepasswordpolicytoprovidethepassword
requirements.
1ChooseGuestAccess>Configure>Sponsored-GuestPortalsorSelf-RegisteredGuestPortals>
Edit>PortalPageCustomization>ErrorMessages.
2Searchforthekeyword“policy.”
Rules for Guest Username Policies
CiscoISEhasthefollowingbuilt-inrulesforguestusernamepolicies:
•Changestotheguestusernamepolicydonotaffectexistingaccounts,untiltheguestaccountshave
expiredandneedtobechanged.
•Thespecialcharacters,/,and%cannotbeused.
•Minimumlengthandminimumrequiredcharactersapplytoallsystem-generatedusernames,including
usernamesbasedonemailaddresses.
•Passwordscannotmatchusernames.
Set the Guest Username Policy
Youcanconfigurerulesforhowguestusernamesarecreated.Ageneratedusernamecanbecreatedbasedon
theemailaddress,orbasedonthefirstnameandlastnameoftheguest.TheSponsorcanalsocreatearandom
numberofguestaccountstosavetimewhencreatingmultipleguests,orwhenguestnamesandemailaddresses
arenotavailable.Randomlygeneratedguestusernamesconsistofamixtureofalphabetic,numeric,andspecial
characters.Thesesettingsaffectallguests.
Procedure
Step 1TodefinetheguestusernamepoliciesforallGuestandSponsorportals,chooseGuestAccess>Settings
>GuestUsernamePolicy.
Step 2EntertheMinimumusernamelength(incharacters)fortheguestusernames.
Step 3ChooseoneoftheoptionsunderUsernameCriteriaforKnownGueststospecifythepolicyforcreating
usernamesforknownguests.
Step 4ChooseoneofthefollowingoptionsunderCharactersAllowedinRandomly-GeneratedUsernamesto
specifythepolicyforcreatingrandomusernamesforguests:
•Useallcharactersfromeachcharacterset.
•Topreventtheuseofcertaincharacters,chooseCustomfromthedrop-downmenu,anddeletethese
charactersfromthepredefinedandcompletesets.
Step 5Entertheminimumnumberofcharacterstousefromeachset.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
301
Guest and Sponsor Accounts 
						

							Thetotalnumberofcharactersfromthethreecharactersetsshouldnotexceedthenumberspecifiedin
Minimumusernamelength.
Step 6ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast
savedvalues.
What to Do Next
Youshouldcustomizetheerrormessagesthatarerelatedtotheusernamepolicytoprovidetheusername
requirements.
1ChooseGuestAccess>Configure>Sponsored-GuestPortals,Self-RegisteredGuestPortals,
SponsorPortals,orMyDevicesPortals>Edit>PortalPageCustomization>ErrorMessages.
2Searchforthekeyword“policy.”
SMS Providers and Services
SMSservicesarerequiredwhenyouandsponsorswanttosendSMSnotificationstogueststhatareusing
credentialedGuestportals.Wheneverpossible,configureandprovidefreeSMSserviceproviderstolower
yourcompany'sexpenses.
CiscoISEsupportsavarietyofcellularserviceprovidersthatprovidefreeSMSservicestotheirown
subscribers.Youcanusetheseproviderswithoutaservicecontractandwithoutconfiguringtheiraccount
credentialsinCiscoISE.TheseincludeATT,Orange,Sprint,TMobile,andVerizon.
YoucanalsoaddothercellularserviceprovidersthatofferfreeSMSservicesoraglobalSMSserviceprovider,
suchasaClick-A-Tell.ThedefaultglobalSMSserviceproviderrequiresaservicecontractandyoumust
configuretheiraccountcredentialsinCiscoISE.
•Ifself-registeringguestspicktheirfreeSMSserviceproviderontheSelf-Registrationform,SMS
notificationswiththeirlogincredentialsaresenttothemfreeofcost.IftheydonotpicktheirSMS
serviceprovider,thenthedefaultglobalSMSserviceprovidercontractedbyyourcompanyisusedto
sendtheSMSnotifications.
•IfyouplantoallowsponsorstosendSMSnotificationstoguestswhoseaccountstheyhavecreated,
youshouldcustomizethesponsorportalandselectalltheappropriateSMSserviceprovidersthatcan
beusedbythesesponsors.IfyoudonotselectanySMSserviceprovidersfortheSponsorportal,the
defaultglobalSMSserviceprovidercontractedbyyourcompanywillprovidetheSMSservices.
SMSprovidersareconfiguredasSMSGatewaysinISE.EmailfromISEisconvertedtoSMSbytheSMS
gateway.
Related Topics
ConfigureSMSGatewaystoSendSMSNotificationstoGuests,onpage302
SMSGatewaySettings,onpage722
Configure SMS Gateways to Send SMS Notifications to Guests
YoumustsetupSMSgatewaysinCiscoISEtoenable:
   Cisco Identity Services Engine Administrator Guide, Release 1.3
302
Guest and Sponsor Accounts 
						

							•SponsorstomanuallysendSMSnotificationstoguestswiththeirlogincredentialsandpasswordreset
instructions.
•GueststoautomaticallyreceiveSMSnotificationswiththeirlogincredentialsaftertheysuccessfully
registerthemselves.
•GueststoautomaticallyreceiveSMSnotificationswithactionstotakebeforetheirguestaccountsexpire.
Whenenteringinformationinthefields,youshouldupdatealltextwithin[],suchas[USERNAME],
[PASSWORD],[PROVIDER_ID],etc.,withinformationspecifictoyourSMSprovider'saccount.
Before You Begin
ConfigureadefaultSMTPservertousefortheSMSEmailGatewayoption.
Procedure
Step 1ChooseAdministration>System>Settings>SMSGateway.
Step 2ClickAdd.
Step 3EnteranSMSGatewayProviderName.
Step 4SelectaProviderInterfaceTypeandentertherequiredinformation:
•SMSEmailGatewaytosendSMSviaanemailserver.
•SMSHTTPAPItosendSMSviaanHTTPAPI(GETorPOSTmethod).
ForinformationaboutconfiguringanSMSEmailGatewayandanSMSHTTPAPIgateway,seeSMSGateway
Settings,onpage722.
Step 5CheckBreakuplongmessageintomultiplepartstoenableCiscoISEtodividemessagesthatexceed140
bytesintomultiplemessages.
MostSMSprovidersdividelongSMSmessagesintomultiplepartsautomatically.MMSmessagescanbe
longerthanSMSmessages.
Step 6ClickSubmit.
What to Do Next
IfyouconfiguredanewSMSgateway,youcan:
•SelecttheSMSserviceprovidertousewhensendingSMSnotificationsaboutexpiringaccountsto
guests.SeeCreateorEditaGuestType,onpage293.
•SpecifywhichoftheconfiguredSMSprovidersshoulddisplayontheSelf-Registrationformfor
self-registeringgueststopickfrom.SeeCreateaSelf-RegisteredGuestPortal,onpage312.
Guest Portals
Whenpeoplevisitingyourcompanywishtouseyourcompany’snetworktoaccesstheinternet,orresources
andservicesonyournetwork,youcanprovidethemnetworkaccessthroughaGuestportal.Employeescan
usetheseGuestportalstoaccessyourcompany’snetwork,ifconfigured.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
303
Guest Portals 
						

							TherearethreedefaultGuestportals:
•HotspotGuestportal—Networkaccessisgrantedwithoutrequiringanycredentials.Usually,an
AcceptanceofUserPolicy(AUP)mustbeacceptedbeforenetworkaccessisgranted.
•Sponsored-Guestportal—Networkaccessisgrantedbyasponsorwhocreatesaccountsforguests,and
providestheGuestwithlogincredentials.
•Self-RegisteredGuestportal—Guestscancreatetheirownaccountscredentials,andmayneedsponsor
approvalbeforetheyaregrantednetworkaccess.
CiscoISEcanhostmultipleGuestportals,includingapredefinedsetofdefaultportals.
ThedefaultportalthemeshavestandardCiscobrandingthatyoucancustomizethroughtheAdminportal.
Wirelesssetuphasitsowndefaulttheme(CSS)andyouareabletomodifysomebasicsettingssuchaslogo,
banner,backgroundimage,coloringandfonts.InISE,youcanalsochoosetofurthercustomizeyourportal
bychangingmoresettingsandgointoadvancedcustomizations.
Credentials for Guest Portals
CiscoISEprovidessecurednetworkaccessbyrequiringgueststologinusingvarioustypesofcredentials.
Youcanrequirethatguestsloginusingoneoracombinationofthesecredentials.
•Username—Required.Appliestoallguestsusingend-userportals(exceptHotspotGuestportals)and
isderivedfromtheusernamepolicy.Theusernamepolicyappliesonlytosystem-generatedusernames
andnottousernamesspecifiedusingtheGuestAPIprogramminginterfaceortheself-registeringprocess.
YoucanconfigurethepolicysettingsthatapplytousernamesatGuestAccess>Settings>Guest
UsernamePolicy.Guestscanbenotifiedoftheirusernameinanemail,SMS,orinprintedform.
•Password—Required.Appliestoallguestsusingend-userportals(exceptHotspotGuestportals)andis
derivedfromthepasswordpolicy.Youcanconfigurethepolicysettingsthatapplytopasswordsat
GuestAccess>Settings>GuestPasswordPolicy.Guestscanbenotifiedoftheirpasswordinan
email,SMS,orinprintedform.
•Accesscode—Optional.AppliestoguestsusingtheHotspotGuestandCredentialedGuestportals.An
accesscodeisprimarilyalocallyknowncodethatisgiventophysicallypresentguests(eithervisually
viaawhiteboardorverballybyalobbyambassador).Itwouldnotbeknownandusedbysomeone
outsidethepremisestogainaccesstothenetwork.IftheAccesscodesettingisenabled:
◦SponsoredguestsarepromptedtoenteritontheLoginpage(alongwithausernameandpassword).
◦GuestsusingtheHotspotGuestportalarepromptedtoenteritontheAcceptableUsePolicy(AUP)
page.
•Registrationcode—Optional.Appliestoself-registeringguestsandissimilartoanaccesscodeinhow
itisprovidedtotheself-registeringguests.IftheRegistrationcodesettingisenabled,self-registering
guestsarepromptedtoenteritontheSelf-Registrationform.
Theusernameandpasswordcanbeprovidedbyasponsoratyourcompany(forsponsoredguests),ora
CredentialedGuestportalcanbeconfiguredtoallowgueststoregisterthemselvestoobtainthesecredentials.
Related Topics
UserAuthenticationPolicySettings
GuestTypesandUserIdentityGroups,onpage292
   Cisco Identity Services Engine Administrator Guide, Release 1.3
304
Guest Portals