Support Guests

Provide Account Details to Known Guests

Create Account Settings

Related Information

Create Random Guest Accounts

You can create a set of multiple random guest accounts in advance, record the details separately, and store them in the system for future use. For example, if you are a lobby ambassador who needs to distribute guest accounts on a regular basis, you can save time by using these generic, randomly created accounts.

Step 1

Click Random on the Create Accounts page.

Step 2

Retain or update the Guest Type you want to assign to the guest.

The various types of guests and their access privileges are defined by your system administrator.

The maximum number of devices that guests can simultaneously connect to the network and the maximum duration time for network access are displayed for the guest type you select.

Step 3

Enter the Number of Accounts to create.

The maximum number of random guest accounts displayed that you can create at a time is configured by your system administrator.

Step 4

Based on how your system administrator configured this setting, you can either enter, edit or use the predefined Username Prefix to add to each account name.

The remainder of the username is generated randomly adhering to the username policies set by your system administrator.

Step 5

Retain or update the defaults for the mandatory settings and enter information in the other fields, as desired. The system administrator can configure multiple selections for Language, Location, and SSID. However, if only one selection is specified, it will not display, but is automatically assigned when you create the guest accounts. You can view this selection in the guest account details after the accounts are created.

Note

When setting time durations for accounts, the start and end times you define are applicable in the time zone for the location you pick.

Step 6

Click Create to create the specified number of random guest accounts. If you created:

50 or less random accounts—An Account Information dialog box displays with the randomly generated usernames and passwords for the multiple accounts you created.
More than 50 random accounts—A message informs you that the accounts are being created in the background and to check the Notices page for a status on the operation.

What to Do Next

When you generate random guest accounts, you probably do not have guest information such as email addresses or phone numbers. You can print the account details and manually distribute the login credentials to the guests. If you created more than 50 accounts, open the specific notice on the Notices page to view account details for up to 50 accounts. To view all the accounts created, go to the Manage Accounts page.

Related References

Create Account Settings

Import Guest Accounts

If your company maintains account information for authorized visitors in an external database or file, you can create guest accounts for these users by importing their information into the Sponsor portal. The file containing the account information must be a .csv file, which the Sponsor portal then parses and creates new guest user accounts for each entry in the file.

Before You Begin

You should have the necessary permissions to import guest account information.
You cannot import guest account information from a mobile device (running Apple iOS, Android, and so on), so ensure that you are importing account information using a desktop device (running Apple OSX, Windows, and so on).

Step 1

Click Import on the Create Accounts page.

Step 2

Retain or update the Guest Type you want to assign to the guest.

The various types of guests and their access privileges are defined by your system administrator.

The maximum number of devices that guests can simultaneously connect to the network and the maximum duration time for network access are displayed for the guest type you select.

Step 3

Click Download Template to get a template to use for the import file. Ensure that the file you are importing conforms to the required structure before importing it. Additionally, if the file includes multi-byte characters, you must save the file in UTF-8 format.

Step 4

Click Browse to locate and select the .csv file that contains the guest information needed to create the guest accounts.

Step 5

Retain or update the defaults for the mandatory settings and enter information in the other fields, as desired. The system administrator can configure multiple selections for Language, Location, and SSID. However, if only one selection is specified, it will not display, but is automatically assigned when you create the guest accounts. You can view this selection in the guest account details after the accounts are created.

Note

When setting time durations for accounts, the start and end times you define are applicable in the time zone for the location you pick.

Step 6

Click Import to import the account information from the external database or file. A message informs you that the accounts are being created in the background and to check the Notices page for a status on the operation.

What to Do Next

On the Notices page, open the specific notice to view account details for up to 50 accounts. If you imported more than 50 accounts, go to the Manage Accounts page, to view all the accounts created.

Related References

View and Provide Random Guest Account Details

Create Account Settings

Privacy of Guest Passwords

You can create guest accounts for authorized visitors requiring access to your company’s network and internal resources. When you create accounts, whether it is for a known guest, or randomly for a multiple set of guests, or when importing a batch of guest accounts from an external database, Cisco ISE generates passwords for these accounts.

If your system administrator set you up with the required privileges, you can view these system generated passwords:

When managing guest accounts in the account details for each account.
If you choose to be notified of the account details at the same time you notify your guests.

However, if your guests are permitted to change their passwords and do so after they log into the Guest portals, you can no longer view these passwords, as they are considered private.

If guests lose or forget their passwords after they change them, you cannot simply resend their passwords to them. You have to reset their passwords to random passwords and notify them of the new passwords.

Related Tasks

Resend Guest Passwords

Reset Guest Passwords

Create Account Settings

You can retain the defaults or change these settings when creating guest accounts. Your system administrator may enable additional settings for which you may need to enter information.

Create Account Settings
Field	Usage Guidelines
Guest Type	Select the type of guests whose accounts you are creating. If only one guest type is configured by your system administrator, you can only use this type to create guest accounts. Cisco ISE includes these default guest types to map guests to their appropriate network access privileges: Daily—Default settings allow guests network access for just 1-5 days. Weekly—Default settings allow guests network access for a couple of weeks. Contractor—Default settings allow guests network access for up to a year. Your system administrator might restrict this list or create additional guest types. The system administrator can set up guest types to Allow guest to bypass the Guest portal. In this case, the guest accounts created using this guest type are enabled automatically, and their states display as Active, even if the guests have not yet logged into a Cisco ISE web portal. If this option is not configured, the accounts are not enabled until the guests actually log into a web portal and their initial states display as Created.
SMS Provider	This field displays only if more than one SMS provider has been configured for selection by your system administrator. If only one provider is configured, it will not display as it is the only option available for this Sponsor portal. If you know your guest's cellular provider and it is listed under SMS Provider, select it to send a SMS notification with the login credentials to the guest. If the cellular provider is not listed, then select the default global provider listed. Include the country code of the guest's phone number if using the default global provider. The supported phone number formats include: +1 ### ### ####, ###-###-####, (###) ### ####, ##########, 1########## and so on.
Group Tag	Groups certain guests accounts for tracking and searching purposes. For instance, you can assign a tag to all the guests attending training at a certain location. You can then search for these guests to either extend their account duration if the training is not completed in time or delete their accounts after the training is finished.
Location	This field displays only if more than one location has been configured for selection by your system administrator. If only one location is configured, it will not display as it is the only option available for this Sponsor portal. Select the location to be used for the guest accounts. This determines the time zones that applies to the guests and helps define valid time ranges and other time parameters that apply to their accounts. The time left for a guest account is related to the specific location assigned to it, and not the sponsor's local time.
SSID	This field displays only if more than one SSID has been configured for selection by your system administrator. If only one SSID is configured, it will not display as it is the only option available for this Sponsor portal. Select the SSID of the network that guests will log into. This SSID is included in the account notifications sent to the guests.
Language	This field displays only if more than one language has been configured for selection by your system administrator. If only one language is configured, it will not display as it is the only option available for this Sponsor portal. Choose the language used when sending account notifications (email, text, and print) to the guests.
Days; From date, To date; From time, To time	Define the account duration in terms of the maximum number of days, the dates, and the hours when the guests can access the network. Make sure that the amount of time does not exceed the maximum defined by the system administrator.

Manage Guest Accounts

Sponsor Portal Manage Accounts Page
Edit Guest Accounts
Resend Guest Passwords
Extend Guest Account Durations
Suspended and Expired Guest Accounts
Suspend Guest Accounts
Delete Guest Accounts
Reset Guest Passwords
Reinstate Guest Accounts
Manage Accounts Page Details
Manage Account States

Sponsor Portal Manage Accounts Page

You can use the Manage Accounts page to manage the guest accounts you created or have the authority to manage. You can perform the following actions:

Edit and delete accounts
Extend the account durations of accounts
Suspend accounts
Reinstate accounts
Resend and reset passwords for accounts

Edit Guest Accounts

You can edit any guest account, regardless of the state it is in.

Step 1	On the Manage Accounts page, select the guest account that you want to edit.
Step 2	Click Edit.
Step 3	Edit any of the fields that display. For instance, you may want to change the defaults for Language and Location that you retained when you first created the guest accounts. You may want to add information such as names, email addresses, and phone numbers that was not available when you first created random guest accounts. If you change (reduce or extend) the time duration for an account, the time left is changed based on the specific location assigned to it, and not the sponsor's local time.
Step 4	Click Save.
Step 5	View the changes you made to their account information.

Related References

Resend Guest Passwords

Guests may sometimes be unable to log into the network because they have lost or forgotten their passwords. You can help these guests regain access to the network by resending their original passwords.

Before You Begin

You cannot resend passwords to guests who have changed them. If these guests have lost or forgotten their new passwords, you must reset them and notify the guests.
You can resend passwords for accounts that are either Created or Active.
You cannot resend passwords for accounts that are either Pending Approval, Suspended, Expired, or Denied.

Step 1	On the Manage Accounts page, select the guest accounts whose passwords you want to resend.
Step 2	Click Resend to send the guests their account details again. You are asked to select how you want to notify the guests of their new account details, either by email, text, or print.
Step 3	In the Resend pop-up window, select the various notification options (for both guests and sponsors) and click OK.

Related References

Extend Guest Account Durations

You can extend the account durations for guests before or after their accounts expire, so that they can access the network for longer than originally permitted. You can also extend the account durations when editing guest accounts.

If guest accounts have expired, they are no longer able to connect to the network. An automated process runs periodically (based on criteria set by your system administrator) that removes (purges) all expired accounts from the system. If that happens before you can extend the account duration for an expired account, you will need to create new accounts for these guests.

Before You Begin

You can extend accounts that are either Created, Active, or Expired.
You cannot extend accounts that are either Suspended or Denied. You can reinstate them.

Step 1	On the Manage Accounts page, select the guest account that you want to extend.
Step 2	Click Extend.
Step 3	Enter the extension information and click OK. The Expiration Date and Time Left are automatically updated with the new time duration. The time left is related to the specific location assigned to the guest account, and not the sponsor's local time.
Step 4	Verify that the Expired accounts' duration times have been extended and their states are reset as follows: For accounts awaiting approval, to Pending Approval. For accounts that are configured to bypass the credentialed Guest portal, to Active. For accounts that are not configured to bypass the credentialed Guest portal, to Created.

Related References

Suspended and Expired Guest Accounts

When guest accounts are suspended manually by you or expire, the affected guests are disconnected from the network and can no longer access it.

Regardless of their state, active, pending and so on, guest accounts expire when they reach the end of their account duration, which you defined when you created the accounts.

Suspended and expired accounts are automatically purged based on a schedule defined by your system administrator, but the default is every 15 days. After an account is purged, you must create a new account for that guest. However, you can reinstate suspended accounts and extend expired accounts before they are purged.

Suspend Guest Accounts

You can suspend the accounts of guests, which disconnects them from the network and prevents them from accessing it. However, their accounts are retained in the Cisco ISE database.

Before You Begin

You can suspend accounts that are either Created or Active.
You cannot suspend accounts that are either Pending Approval, Expired, or Denied.

Step 1	On the Manage Accounts page, select the guest accounts that you want to suspend.
Step 2	Click Suspend. If configured by your system administrator, you may be asked to provide a reason for the suspension.
Step 3	Click OK to confirm.
Step 4	Verify that the accounts are now listed as Suspended.

Related References

Delete Guest Accounts

You can delete any guest account, regardless of the state it is in.

Step 1	On the Manage Accounts page, select the guest accounts that you want to delete.
Step 2	Click Delete.
Step 3	Click OK to confirm.
Step 4	Ensure that the accounts no longer appear in the account list.

Related References

Reset Guest Passwords

Guests may sometimes be unable to log into the network because they have lost or forgotten their passwords. You can help these guests regain access to the network by resetting their passwords.

Before You Begin

You can reset passwords regardless of whether guests have changed their passwords or not.
You can reset passwords for accounts that are either Created or Active.
You cannot reset passwords for accounts that are either Pending Approval, Suspended, Expired, or Denied.

Step 1	On the Manage Accounts page, select the guest accounts whose passwords you want to reset.
Step 2	Click Reset Password to generate random system passwords. You are asked to confirm the reset and select how you want to notify the guests of their new account details, either by email, text, or print.
Step 3	In the Reset Password pop-up window, select the various notification options (for both guests and sponsors) and click OK.

Related References

Reinstate Guest Accounts

You can reinstate guest accounts that you suspended previously or denied approval.

Before You Begin

You can reinstate accounts that are either Suspended or Denied.
You cannot reinstate accounts that are either Created, Active, Pending Approval, or Expired.

Step 1	On the Manage Accounts page, select the guest accounts that you want to reinstate.
Step 2	Click Reinstate.
Step 3	Click OK to confirm.
Step 4	Verify that the accounts are reinstated and their states are reset as follows: For Suspended accounts—To either Created or Active. Accounts change to Expired, if they expired while suspended. For Denied accounts—To either Created or Active. Accounts change to Expired, if they expired while denied.

Related References

Manage Accounts Page Details

The Manage Accounts page allows you to manage the guest accounts you have created and other accounts based on your privileges set by your system administrator.

Use these settings to manage guest accounts.

Manage Accounts Page Details
Action	Usage Guidelines	Eligible Account States
Edit	Make changes to a selected account.	All, except Suspended, Denied.
Resend	Email, text, or print account details for the selected guests.	Active, Created
Extend	Adjust the access time period or reactivate the selected expired guest accounts.	Active, Created, Expired
Suspend	Disable the selected guest accounts without deleting them from the system. You may be prompted to provide reasons for suspending an account.	Active, Created
Delete	Remove the selected guest accounts from the Cisco ISE database.	All
Reset Password	Reset the selected guest passwords to random passwords and notify the guests of the account details.	Active, Created
Reinstate	Enable the selected suspended guest accounts and approve previously denied accounts.	Suspended, Denied
Refresh	View any changes to the displayed accounts.	Not applicable

Manage Account States

The account state displays details about guest accounts.

When you delete an account, it no longer displays on this page and it is removed from the Cisco ISE database.

Manage Account States
Current State	Description	New State
Active	Guests with these accounts have successfully signed in through a credentialed Guest portal, or bypassed the credentialed Guest captive portal. In the latter case, the accounts belong to guest types that are configured to bypass the credentialed Guest captive portal. These guests can access the network by providing their login credentials to the native supplicant on their device.	Account states change based on the action taken on them.
Created	The accounts have been created, but the guests have not yet logged into a credentialed Guest portal. In this case, the accounts are assigned to guest types that are not configured to bypass the credentialed Guest captive portal. Guests must first sign in through the credentialed Guest captive portal before they are able to access other parts of the network.	Account states change based on the action taken on them.
Denied Accounts that expired while in a denied state remain as Denied.	The accounts are denied access to the network.	If you reinstate denied accounts, their states change to: Active or Created based on the assigned guest type configuration. Expired, if they expired while denied, and are purged in the next purge cycle. All denied accounts that are not reinstated are purged in the next purge cycle. Denied accounts that expired cannot be extended (reactivated); you must create new accounts.
Expired	The time period for the account has ended.	If you extend unexpired accounts, their states remain unchanged. If you extend (reactivate) expired accounts, their states change to: Active, if the guests are configured to bypass the credentialed Guest captive portal. Previous states, if the guests are not configured for bypass.
Pending Approval	The accounts are awaiting approval to access the network.	If approved, based on the guest type configuration, the account can be Active or Created. If denied, it appears on the `Manage Accounts` page as Denied.
Suspended Accounts that expired while suspended remain as Suspended.	The accounts have been suspended by you or another sponsor, who has the privilege to do so.	If you reinstate suspended accounts, their states change to: Previous states, if the accounts have not expired in the meantime. Expired, if they expired while suspended, and are purged in the next purge cycle. However, you can extend these accounts before the next purge cycle.

Pending Guest Accounts

Sponsor Portal Pending Accounts Page
Approve Pending Accounts
Deny Pending Accounts
Pending Accounts Page Details
Pending Accounts States

Sponsor Portal Pending Accounts Page

You can use the Pending Accounts page to process accounts for self-registering guests who are awaiting sponsor approval before they are allowed network access. You can:

Approve one, multiple, or all pending accounts.
Deny approval for one, multiple, or all pending accounts.

Approve Pending Accounts

You can approve accounts listed as either Pending Approval or Denied to provide guests access to the network.

Before You Begin

On a desktop device, you can select multiple check boxes or use the select all checkbox to select several guest accounts simultaneously. If using a mobile device, you can only select individual accounts and approve them one at a time.

Step 1	On the Pending Accounts page: If approving multiple guest accounts on a single page, select the specific accounts and click Approve before moving to the next page. If approving all the guest accounts on a single page, check the select all checkbox above the list and click Approve. This will not select guest accounts on other pages.
Step 2	Click OK to confirm that you want to approve the selected accounts. The approved accounts no longer display on the Pending Accounts page, but display on the Manage Accounts page.

What to Do Next

On the Manage Accounts page, verify that the approved accounts are listed as either Created or Active. If accounts expired while awaiting approval, they are now listed as Expired on this page and will no longer display on the Pending Accounts page.

Related References

Pending Accounts Page Details

Pending Accounts States

Deny Pending Accounts

You can deny approval for accounts listed as either Pending Approval or Approved and prevent guest access to the network.

Before You Begin

Step 1	On the Pending Accounts page: If denying approval for multiple guest accounts on a single page, select the specific accounts and click Deny before moving to the next page. If denying approval for all the guest accounts on a single page, check the select all checkbox above the list and click Deny. This will not select guest accounts on other pages.
Step 2	Click OK to confirm that you want to deny approval for the selected accounts. The denied accounts display on the Pending Accounts page as Denied until you leave the page. After that, they display as Denied on the Manage Accounts page.

What to Do Next

On the Manage Accounts page, verify that the accounts that were denied approval are listed as Denied. If the denied accounts expired while awaiting approval, they are now listed as Expired.

Related References