Cisco Ise 13 User Guide
Have a look at the manual Cisco Ise 13 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
◦Viewmessagesin—SpecifythelanguagetousewhendisplayingemailorSMSnotificationsas yousetthemup. ◦Email—Sendaccountexpirationnoticesbyemail. ◦Usecustomizationfrom—Applythesamecustomizationsthatyouconfiguredfortheselected portaltothisGuestType'saccountexpirationemails. ◦Copytextfrom—ReuseemailtextthatyoucreatedforanotherGuestType'saccountexpiration email. ◦Sendtestemailtomeat ◦SMS—SendaccountexpirationnoticesbySMS. ThesettingsthatfollowforSMSarethesameasforemailnotifications,exceptthatyouchoose anSMSgatewayforSendtestSMStome. •SponsorGroups—Specifythesponsorgroupswhosememberscancreateaguestaccountusingthis guesttype.Deletethesponsorgroupsthatyoudonotwanttohaveaccesstothisguesttype. What to Do Next •Createormodifysponsorgroupstousethisguesttype.Formoreinformation,seeSponsorGroups,on page317. •Ifappropriate,assignthisguesttypetoself-registeringguestsintheSelf-RegisteredGuestportal.For moreinformation,seeCreateaSelf-RegisteredGuestPortal,onpage312. Disable a Guest Type Youcannotdeletethelastremainingguesttypeorguesttypesthatarebeingusedbyguestaccounts.Ifyou wanttodeleteaguesttypethatisinuse,firstensurethatitisnolongeravailableforuse.Disablingaguest typedoesnotaffectguestaccountsthatwerecreatedwiththatguesttype. Thefollowingstepsexplainhowtoprepareforanddisableatargetguesttype. Procedure Step 1Identifythesponsorgroupsthatallowthesponsortocreateguestsusingthetargetguesttype.ChooseGuest AccessConfigureSponsorGroups,andopeneachsponsorgroupandexaminetheThissponsorgroupcan createaccountsusingtheseguesttypeslist. Step 2IdentifytheSelf-Registeredportalsthatassignthetargetguesttype.ChooseGuestAccess>Configure> GuestPortals.OpeneachSelf-RegisteredGuestportal.Iftheportalisusingthespecificguesttype,expand PortalSettings,andchangetheassignedguesttypeinthefieldEmployeesusingthisportalasguestsinherit loginoptionsfrom:. Step 3Opentheguesttypeyouwishtodelete,anddeleteallsponsorgroupsthatyouidentifiedintheprevioussteps. Thisactioneffectivelypreventsallsponsorsfromusingcreatinganewguestaccountwiththisguesttype. ChooseGuestAccess>Configure>GuestType. Cisco Identity Services Engine Administrator Guide, Release 1.3 295 Guest and Sponsor Accounts
That'sit.Youcan'tactuallydeletetheguesttype.Makesureyoudon'tuseinanyportalsinthefuture. Changing Guest Account Attributes Whenaguestaccountiscreated,attributesareconfiguredforthataccountbytheGuestType. IfyoueditanexistingGuestTypetochangethetimeperiodorotherattributes,thenewattributeswillnotbe appliedtoexistingguestaccounts. TochangetheattributesofanexistingGuestaccount,createanewGuesttypewithnewattributes,andapply thatGuestTypetoanexistingaccount.ThataccountwilltakeonalltheattributesofthenewGuestType, includingdefaultaccesstimes,datesandduration.Inaddition,thecustomfieldsfromtheoriginalGuestType arecopiedtothenewGuestaccount,evenifthecustomfieldisblank. ASponsorcanalsoextendtheaccountdurationbeforethetimeperiodhasexpired. Schedule When to Purge Expired Guest Accounts Whenanactiveorsuspendedguestaccountreachestheendofitsaccountduration(asdefinedbythesponsor whencreatingtheaccount),theaccountexpires.Whenguestaccountsexpire,theaffectedguestscannotaccess thenetwork.Sponsorscanextendexpiredaccountsbeforetheyarepurged.However,afteranaccountis purged,sponsorsmustcreatenewaccounts. Whenexpiredguestaccountsarepurged,theassociatedendpointsandreportingandlogginginformationare retained. CiscoISEautomaticallypurgesexpiredguestaccountsevery15days,bydefault.TheDateofnextpurge indicateswhenthenextpurgewilloccur.Youcanalso: •ScheduleapurgetooccureveryXdays.ThefirstpurgewilloccurinXdaysatTimeofPurge,then purgesoccureveryXdays. •ScheduleapurgeonagivendayoftheweekeveryXweeks.ThefirstpurgeoccursonthenextDayof WeekatTimeofPurge,thenpurgesoccureveryconfigurednumberofweeksonthatdayandtime. Forexample,onMondayyousetpurgestooccuronThursdayevery5weeks.Thenextpurgewillbe theThursdayofthisweek,nottheThursday5weeksfromnow. •ForceapurgetohappenimmediatelybyclickingPurgeNow. IftheCiscoISEserverisdownwhenthepurgeisscheduledtorun,thepurgeisnotexecuted.Thepurge processwillrunagainatthenextscheduledpurgetime,assumingtheserverisoperationalatthattime. Procedure Step 1ChooseGuestAccess>Settings>GuestAccountPurgePolicy. Step 2Chooseoneoftheseoptions: •ClickPurgeNowtoimmediatelypurgetheexpiredguestaccountrecords. •CheckSchedulepurgeofexpiredguestaccountstoscheduleapurge. Cisco Identity Services Engine Administrator Guide, Release 1.3 296 Guest and Sponsor Accounts
Aftereachpurgeiscompleted,theDateofnextpurgeisresettothenextscheduledpurge.Note Step 3Specifyafterhowmanydaysofinactivitytopurgeuser-specificportalrecordsmaintainedintheCiscoISE databaseforLDAPandActiveDirectoryusers. Step 4ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast savedvalues. Add Custom Fields for Guest Account Creation Whenprovidingguestaccess,youmaywanttocollectinformationfromyourguestsbeyondjusttheirnames, emailaddresses,andphonenumbers.CiscoISEprovidescustomfieldsthatyoucanusetocollectadditional informationaboutgueststhatisspecifictoyourcompany’sneeds.Youcanassociatethecustomfieldswith guesttypesandwiththeSelf-RegisteredGuestandSponsorportals.CiscoISEdoesnotprovideanydefault customfields. Procedure Step 1Toadd,edit,ordeletecustomfieldsforallGuestandSponsorportals,chooseGuestAccess>Settings> CustomFields. Step 2EntertheCustomFieldName,pickaDataTypefromthedrop-downlist,andenterTipTexttohelpprovide additionalinformationaboutthecustomfield.Forinstance,ifyouenterDateofBirth,pickDate-MDY,and enteratipforthedateformatasMM/DD/YYYY. Step 3ClickAdd. Thecustomfieldappearsinthelistinalphabeticalorderorinthecontextofthesortedorder. Step 4ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast savedvalues. Ifyoudeleteacustomfield,itwillnolongerbeavailableforselectionintheCustomFieldslistfor guesttypesandintheSelf-RegisteredGuestandSponsorportalssettings.Ifthefieldisbeingused, Deletewillbedisabled. Note What to Do Next Youcanincludethedesiredcustomfields: •Whendefiningaguesttypesothataccountscreatedwiththatguesttypewillincludethisinformation. SeeCreateorEditaGuestType,onpage293. •WhenconfiguringtheSponsorportalforsponsorstousewhencreatingguestaccounts.See#unique_537. •Whenrequestinginformationfromself-registeringguestsusingaSelf-RegisteredGuestportal.See CreateaSelf-RegisteredGuestPortal,onpage312. Cisco Identity Services Engine Administrator Guide, Release 1.3 297 Guest and Sponsor Accounts
Specify Email Addresses and SMTP Servers for Email Notifications CiscoISEallowsyoutosendemailstosponsorsandguests,notifyingthemofinformationandinstructions. YoucanconfigureSMTPserverstodelivertheseemailnotifications.Youcanalsospecifytheemailaddress fromwhichthenotificationswillbesenttoguests. Procedure Step 1TospecifyemailsettingsandconfigureSMTPserversforallGuestandSponsorportals,chooseGuestAccess >Settings>GuestEmailSettings. Step 2Enableemailnotificationstoguestsischeckedbydefault.Ifyoudisablethissetting,guestswillnotreceive emailnotificationsregardlessofanyothersettingsyoumayhaveenabledwhileconfiguringGuestandSponsor portals. Step 3EntertheDefault“From”emailaddressthatisdesignatedforsendingemailnotificationstoguests.For example,[email protected]. Step 4Dooneofthefollowing: •CheckSendnotificationsfromsponsor'semailaddress(ifsponsored)ifyouwantgueststoreceive notificationsfromthesponsorwhocreatedtheiraccounts.Self-registeringguestswillreceivenotifications fromthedefaultemailaddress. •CheckAlwayssendnotificationsfromthedefaultemailaddressifyouwantgueststoreceive notifications,regardlessofwhethertheyaresponsoredandself-registering. Step 5ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast savedvalues. Assign Guest Locations and SSIDs AGuestLocationdefinesanameforatimezone,andisusedbyISEtoenforcetime-relatedsettingsoflogged onGuests.GuestLocationsareassignedtoGuestaccountsbySponsorscreatingaGuestaccount,andby self-registeringGuests.ThedefaultGuestLocationisSanJose.IfnootherGuestLocationsareadded,all accountsareassignedthisGuestLocation.Youcan'tdeletetheSanJoseGuestLocationunlessyoucreate oneormorenewLocations.UnlessallyourGuestswillbeinthesametime-zoneasSanJose,createatleast oneGuestLocationwiththerequiredtime-zone. GuestaccesstimesarebasedontheGuestLocation'stimezone.AGuestusermaynotbeabletologinif theGuestLocation'stimezonedoesn'tmatchthesystemtimezone.Inthiscase,theGuestusermayget an"AuthenticationFailed"error.Youmightseethe"Guestactivetimeperiodnotyetstarted"errormessage inthedebugreport.Asaworkaround,youcanadjusttheGuestaccessstarttimetomatchthelocaltime zoneoftheGuestuserbyusingtheManageAccountsoption. Note TheSSIDsyouaddhereareavailabletoSponsorPortals,soSponsorscantelltheGuestwhichSSIDtoconnect to. Youcan'tdeleteaGuestLocationoraSSIDifitisconfiguredinaSponsorportalorassignedtoaGuest account. Cisco Identity Services Engine Administrator Guide, Release 1.3 298 Guest and Sponsor Accounts
Procedure Step 1Toadd,editordeleteGuestLocationsandSSIDsforGuestandSponsorportals,chooseGuestAccess> Settings>GuestLocationsandSSIDs. Step 2ForGuestLocations: a)Foreachtime-zonethatyouneedtosupport,enteraLocationnameandpickaTimezonefromthe drop-downlist. b)ClickAdd. InaGuestLocation,thenameoftheplace,thenameofthetimezone,andtheGMToffsetare static;youcannotchangethem.TheGMToffsetdoesnotchangewithdaylightsavingstime changes.TheGMToffsetsaretheoppositeofwhatisshowninthelist.Forexample,Etc/GMT+3 isactuallyGMT-3. Note Step 3ForGuestSSIDs: a)EntertheSSIDnamesofthenetworksthatwillbeavailableforgueststouseattheGuestLocations. b)ClickAdd. Step 4ClickSave.Toreverttothelastsavedvalues,clickReset. What to Do Next IfyouaddedanewGuestLocationorSSID,youcan: •ProvidetheSSIDsforSponsorstousewhencreatingGuestaccounts.SeePortalSettingsforSponsor Portals,onpage787. •AddtheGuestLocationstoSponsorGroups,soSponsorsassignedtothatgroupcanusethemwhen creatingguestaccounts.SeeConfigureSponsorGroups,onpage318. •AssigntheGuestLocationsavailabletoself-registeringguestsusingaSelf-RegisteredGuestportal.See CreateaSelf-RegisteredGuestPortal,onpage312. •Forexistingguestaccounts,editthemmanuallytoaddSSIDsorLocations. Rules for Guest Password Policies CiscoISEhasthefollowingbuilt-inrulesforguestpasswords: •TheGuestpasswordpolicyappliestosponsorportals,selfregisteredportals,accountsuploadedina CSVfile,passwordscreatedusingtheERSAPI,andusercreatedpasswords. •Changestotheguestpasswordpolicydonotaffectexistingaccounts,untiltheguestspasswordshave expiredandneedtobechanged. •Passwordsarecasesensitive. •Thespecialcharacters,/,and%cannotbeused. •Minimumlengthandminimumrequiredcharactersapplytoallpasswords. •Passwordscannotmatchusernames. •Newpasswordscannotmatchcurrentpasswords. Cisco Identity Services Engine Administrator Guide, Release 1.3 299 Guest and Sponsor Accounts
•Guestsdonotreceivenotificationspriortopasswordexpiration,unlikeguestaccountexpiration.When guestpasswordsexpire,eithersponsorscanresetthepasswordtoarandompasswordorguestscanlog inusingtheircurrentlogincredentialsandthenchangetheirpassword. Theguestdefaultusernameisfouralpabeticandpasswordisfournumericcharacters.Short,easyto rememberusernamesandpasswordsareadequateforshort-termguests.Youcanchangetheusername andpasswordlengthinISE,ifyoudesire. Note Set the Guest Password Policy and Expiration YoucandefineapasswordpolicyforallGuestportals.AGuestpasswordpolicydetermineshowthepassword isgeneratedforallguestaccounts.Apasswordcanbeamixtureofalphabetic,numeric,orspecialcharacters. Youcanalsosetthenumberofdaysafterwhichguestpasswordswillexpire,requiringgueststoresettheir passwords. TheGuestpasswordpolicyappliestosponsorportals,selfregisteredportals,accountsuploadedinaCSV file,passwordscreatedusingtheERSAPI,andusercreatedpasswords. Procedure Step 1ChooseGuestAccess>Settings>GuestPasswordPolicy. Step 2EntertheMinimumpasswordlength(incharacters)fortheguestpasswords. Step 3Specifythecharactersfromeachcharactersetthatcanbeusedbygueststocreatepasswords. ChooseoneofthefollowingoptionsunderAllowedCharactersandMinimumstospecifythepassword policyforguests: •Useallthecharactersfromeachcharacterset. •Topreventtheuseofcertaincharacters,chooseCustomfromthedrop-downmenu,anddeletethese charactersfromthepredefinedandcompletesets. Step 4Entertheminimumnumberofcharacterstousefromeachset. ThetotalnumberofrequiredcharactersacrossthefourcharactersetsshouldnotexceedtheoverallMinimum passwordlength. Step 5ChooseoneofthefollowingoptionsunderPasswordExpiration: •Specifythefrequency(indays)whenguestshavetochangetheirpasswordsaftertheyfirstlogin.Ifthe guestsdonotresettheirpasswordsbeforetheyexpire,thenexttimetheylogintothenetworkusing theiroriginallogincredentials,theyarepromptedtochangetheirpasswords. •Setthepasswordstoneverexpire. Step 6ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast savedvalues. Cisco Identity Services Engine Administrator Guide, Release 1.3 300 Guest and Sponsor Accounts
What to Do Next Youshouldcustomizetheerrormessagesthatarerelatedtothepasswordpolicytoprovidethepassword requirements. 1ChooseGuestAccess>Configure>Sponsored-GuestPortalsorSelf-RegisteredGuestPortals> Edit>PortalPageCustomization>ErrorMessages. 2Searchforthekeyword“policy.” Rules for Guest Username Policies CiscoISEhasthefollowingbuilt-inrulesforguestusernamepolicies: •Changestotheguestusernamepolicydonotaffectexistingaccounts,untiltheguestaccountshave expiredandneedtobechanged. •Thespecialcharacters,/,and%cannotbeused. •Minimumlengthandminimumrequiredcharactersapplytoallsystem-generatedusernames,including usernamesbasedonemailaddresses. •Passwordscannotmatchusernames. Set the Guest Username Policy Youcanconfigurerulesforhowguestusernamesarecreated.Ageneratedusernamecanbecreatedbasedon theemailaddress,orbasedonthefirstnameandlastnameoftheguest.TheSponsorcanalsocreatearandom numberofguestaccountstosavetimewhencreatingmultipleguests,orwhenguestnamesandemailaddresses arenotavailable.Randomlygeneratedguestusernamesconsistofamixtureofalphabetic,numeric,andspecial characters.Thesesettingsaffectallguests. Procedure Step 1TodefinetheguestusernamepoliciesforallGuestandSponsorportals,chooseGuestAccess>Settings >GuestUsernamePolicy. Step 2EntertheMinimumusernamelength(incharacters)fortheguestusernames. Step 3ChooseoneoftheoptionsunderUsernameCriteriaforKnownGueststospecifythepolicyforcreating usernamesforknownguests. Step 4ChooseoneofthefollowingoptionsunderCharactersAllowedinRandomly-GeneratedUsernamesto specifythepolicyforcreatingrandomusernamesforguests: •Useallcharactersfromeachcharacterset. •Topreventtheuseofcertaincharacters,chooseCustomfromthedrop-downmenu,anddeletethese charactersfromthepredefinedandcompletesets. Step 5Entertheminimumnumberofcharacterstousefromeachset. Cisco Identity Services Engine Administrator Guide, Release 1.3 301 Guest and Sponsor Accounts
Thetotalnumberofcharactersfromthethreecharactersetsshouldnotexceedthenumberspecifiedin Minimumusernamelength. Step 6ClickSave.Ifyoudonotwanttosaveanyupdatesyoumadetothesettings,clickResettoreverttothelast savedvalues. What to Do Next Youshouldcustomizetheerrormessagesthatarerelatedtotheusernamepolicytoprovidetheusername requirements. 1ChooseGuestAccess>Configure>Sponsored-GuestPortals,Self-RegisteredGuestPortals, SponsorPortals,orMyDevicesPortals>Edit>PortalPageCustomization>ErrorMessages. 2Searchforthekeyword“policy.” SMS Providers and Services SMSservicesarerequiredwhenyouandsponsorswanttosendSMSnotificationstogueststhatareusing credentialedGuestportals.Wheneverpossible,configureandprovidefreeSMSserviceproviderstolower yourcompany'sexpenses. CiscoISEsupportsavarietyofcellularserviceprovidersthatprovidefreeSMSservicestotheirown subscribers.Youcanusetheseproviderswithoutaservicecontractandwithoutconfiguringtheiraccount credentialsinCiscoISE.TheseincludeATT,Orange,Sprint,TMobile,andVerizon. YoucanalsoaddothercellularserviceprovidersthatofferfreeSMSservicesoraglobalSMSserviceprovider, suchasaClick-A-Tell.ThedefaultglobalSMSserviceproviderrequiresaservicecontractandyoumust configuretheiraccountcredentialsinCiscoISE. •Ifself-registeringguestspicktheirfreeSMSserviceproviderontheSelf-Registrationform,SMS notificationswiththeirlogincredentialsaresenttothemfreeofcost.IftheydonotpicktheirSMS serviceprovider,thenthedefaultglobalSMSserviceprovidercontractedbyyourcompanyisusedto sendtheSMSnotifications. •IfyouplantoallowsponsorstosendSMSnotificationstoguestswhoseaccountstheyhavecreated, youshouldcustomizethesponsorportalandselectalltheappropriateSMSserviceprovidersthatcan beusedbythesesponsors.IfyoudonotselectanySMSserviceprovidersfortheSponsorportal,the defaultglobalSMSserviceprovidercontractedbyyourcompanywillprovidetheSMSservices. SMSprovidersareconfiguredasSMSGatewaysinISE.EmailfromISEisconvertedtoSMSbytheSMS gateway. Related Topics ConfigureSMSGatewaystoSendSMSNotificationstoGuests,onpage302 SMSGatewaySettings,onpage722 Configure SMS Gateways to Send SMS Notifications to Guests YoumustsetupSMSgatewaysinCiscoISEtoenable: Cisco Identity Services Engine Administrator Guide, Release 1.3 302 Guest and Sponsor Accounts
•SponsorstomanuallysendSMSnotificationstoguestswiththeirlogincredentialsandpasswordreset instructions. •GueststoautomaticallyreceiveSMSnotificationswiththeirlogincredentialsaftertheysuccessfully registerthemselves. •GueststoautomaticallyreceiveSMSnotificationswithactionstotakebeforetheirguestaccountsexpire. Whenenteringinformationinthefields,youshouldupdatealltextwithin[],suchas[USERNAME], [PASSWORD],[PROVIDER_ID],etc.,withinformationspecifictoyourSMSprovider'saccount. Before You Begin ConfigureadefaultSMTPservertousefortheSMSEmailGatewayoption. Procedure Step 1ChooseAdministration>System>Settings>SMSGateway. Step 2ClickAdd. Step 3EnteranSMSGatewayProviderName. Step 4SelectaProviderInterfaceTypeandentertherequiredinformation: •SMSEmailGatewaytosendSMSviaanemailserver. •SMSHTTPAPItosendSMSviaanHTTPAPI(GETorPOSTmethod). ForinformationaboutconfiguringanSMSEmailGatewayandanSMSHTTPAPIgateway,seeSMSGateway Settings,onpage722. Step 5CheckBreakuplongmessageintomultiplepartstoenableCiscoISEtodividemessagesthatexceed140 bytesintomultiplemessages. MostSMSprovidersdividelongSMSmessagesintomultiplepartsautomatically.MMSmessagescanbe longerthanSMSmessages. Step 6ClickSubmit. What to Do Next IfyouconfiguredanewSMSgateway,youcan: •SelecttheSMSserviceprovidertousewhensendingSMSnotificationsaboutexpiringaccountsto guests.SeeCreateorEditaGuestType,onpage293. •SpecifywhichoftheconfiguredSMSprovidersshoulddisplayontheSelf-Registrationformfor self-registeringgueststopickfrom.SeeCreateaSelf-RegisteredGuestPortal,onpage312. Guest Portals Whenpeoplevisitingyourcompanywishtouseyourcompany’snetworktoaccesstheinternet,orresources andservicesonyournetwork,youcanprovidethemnetworkaccessthroughaGuestportal.Employeescan usetheseGuestportalstoaccessyourcompany’snetwork,ifconfigured. Cisco Identity Services Engine Administrator Guide, Release 1.3 303 Guest Portals
TherearethreedefaultGuestportals: •HotspotGuestportal—Networkaccessisgrantedwithoutrequiringanycredentials.Usually,an AcceptanceofUserPolicy(AUP)mustbeacceptedbeforenetworkaccessisgranted. •Sponsored-Guestportal—Networkaccessisgrantedbyasponsorwhocreatesaccountsforguests,and providestheGuestwithlogincredentials. •Self-RegisteredGuestportal—Guestscancreatetheirownaccountscredentials,andmayneedsponsor approvalbeforetheyaregrantednetworkaccess. CiscoISEcanhostmultipleGuestportals,includingapredefinedsetofdefaultportals. ThedefaultportalthemeshavestandardCiscobrandingthatyoucancustomizethroughtheAdminportal. Wirelesssetuphasitsowndefaulttheme(CSS)andyouareabletomodifysomebasicsettingssuchaslogo, banner,backgroundimage,coloringandfonts.InISE,youcanalsochoosetofurthercustomizeyourportal bychangingmoresettingsandgointoadvancedcustomizations. Credentials for Guest Portals CiscoISEprovidessecurednetworkaccessbyrequiringgueststologinusingvarioustypesofcredentials. Youcanrequirethatguestsloginusingoneoracombinationofthesecredentials. •Username—Required.Appliestoallguestsusingend-userportals(exceptHotspotGuestportals)and isderivedfromtheusernamepolicy.Theusernamepolicyappliesonlytosystem-generatedusernames andnottousernamesspecifiedusingtheGuestAPIprogramminginterfaceortheself-registeringprocess. YoucanconfigurethepolicysettingsthatapplytousernamesatGuestAccess>Settings>Guest UsernamePolicy.Guestscanbenotifiedoftheirusernameinanemail,SMS,orinprintedform. •Password—Required.Appliestoallguestsusingend-userportals(exceptHotspotGuestportals)andis derivedfromthepasswordpolicy.Youcanconfigurethepolicysettingsthatapplytopasswordsat GuestAccess>Settings>GuestPasswordPolicy.Guestscanbenotifiedoftheirpasswordinan email,SMS,orinprintedform. •Accesscode—Optional.AppliestoguestsusingtheHotspotGuestandCredentialedGuestportals.An accesscodeisprimarilyalocallyknowncodethatisgiventophysicallypresentguests(eithervisually viaawhiteboardorverballybyalobbyambassador).Itwouldnotbeknownandusedbysomeone outsidethepremisestogainaccesstothenetwork.IftheAccesscodesettingisenabled: ◦SponsoredguestsarepromptedtoenteritontheLoginpage(alongwithausernameandpassword). ◦GuestsusingtheHotspotGuestportalarepromptedtoenteritontheAcceptableUsePolicy(AUP) page. •Registrationcode—Optional.Appliestoself-registeringguestsandissimilartoanaccesscodeinhow itisprovidedtotheself-registeringguests.IftheRegistrationcodesettingisenabled,self-registering guestsarepromptedtoenteritontheSelf-Registrationform. Theusernameandpasswordcanbeprovidedbyasponsoratyourcompany(forsponsoredguests),ora CredentialedGuestportalcanbeconfiguredtoallowgueststoregisterthemselvestoobtainthesecredentials. Related Topics UserAuthenticationPolicySettings GuestTypesandUserIdentityGroups,onpage292 Cisco Identity Services Engine Administrator Guide, Release 1.3 304 Guest Portals