{"id":97567,"date":"2020-10-19T14:42:54","date_gmt":"2020-10-19T12:42:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3"},"modified":"2020-10-19T14:42:54","modified_gmt":"2020-10-19T12:42:54","slug":"cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3","title":{"rendered":"Cisco ISE: Configuring Guest Access on FortiAP. Part 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Cisco<\/p>\n

Welcome to the third publication in the series of articles dedicated to Cisco ISE. Links to all articles in the series are provided below:<\/p>\n

    \n
  1. \n

    Cisco ISE: Introduction, Requirements, Installation. Part 1<\/a><\/noindex><\/p>\n<\/li>\n

  2. \n

    Cisco ISE: Creating Users, Adding LDAP Servers, Integrating with AD. Part 2<\/a><\/noindex><\/p>\n<\/li>\n

  3. \n

    Cisco ISE: Configuring Guest Access on FortiAP. Part 3<\/a><\/noindex><\/p>\n<\/li>\n<\/ol>\n

    This publication takes you into guest access, as well as a step-by-step guide to integrating Cisco ISE and FortiGate for setting up FortiAP \u2014 access points from Fortinet (in general, any device that supports RADIUS CoA <\/strong>\u2014 Change of Authorization).<\/p>\n

    Additionally, I am attaching our articles Fortinet \u2014 a collection of useful materials<\/a><\/noindex>.<\/p>\n

    Note<\/em><\/strong>: Check Point SMB devices do not support RADIUS CoA.<\/p>\n

    The wonderful guide<\/a><\/noindex> in English describes how to create guest access using Cisco ISE on Cisco WLC (Wireless Controller). Let's figure it out!<\/p>\n

    1. Introduction<\/h2>\n

    Guest access (portal) allows providing Internet or internal resource access for guests and users whom you do not want to let into your local network. There are 3 pre-installed types of guest portals (Guest portal):<\/p>\n

      \n
    1. \n

      Hotspot Guest portal \u2014 network access is provided to guests without login credentials. Generally, users are required to accept the company\u2019s \u201cTerms of Use and Privacy Policy\u201d before gaining access to the network.<\/p>\n<\/li>\n

    2. \n

      Sponsored-Guest portal \u2014 network access and login information must be issued by the sponsor \u2014 the user responsible for creating guest accounts on Cisco ISE.<\/p>\n<\/li>\n

    3. \n

      Self-Registered Guest portal \u2014 in this case, guests use existing login information, or they can create an account with login data themselves, although sponsor confirmation is required for network access.<\/p>\n<\/li>\n<\/ol>\n

      Multiple portals can be deployed on Cisco ISE simultaneously. By default, on the guest portal, users will see the Cisco logo and standard common phrases. This can all be customized and even involve mandatory advertisement viewing before gaining access.<\/p>\n

      The setup of guest access can be broken down into 4 main stages: configuring FortiAP, establishing connectivity between Cisco ISE and FortiAP, creating the guest portal, and setting up access policies.<\/p>\n

      2. Configuring FortiAP on FortiGate<\/h2>\n

      FortiGate serves as the access point controller, and all configurations are made on it. FortiAP access points support PoE, so once you connect it to the network via Ethernet, you can start the configuration.<\/p>\n

      1) On FortiGate, go to the tab WiFi & Switch Controller > Managed FortiAPs > Create New > Managed AP<\/em>Using the unique serial number of the access point, which is indicated on the access point itself, add it as an object. Alternatively, it may be discovered automatically and then click Authorize <\/em>using the right mouse button.<\/p>\n

      \"Cisco<\/p>\n

      2) The FortiAP settings may be default; for example, leave them as shown in the screenshot. I highly recommend enabling the 5 GHz mode, as some devices do not support 2.4 GHz.<\/p>\n

      3) Then, go to the tab WiFi & Switch Controller > FortiAP Profiles > Create New <\/em>to create a configuration profile for the access point (protocol version 802.11, SSID mode, channel frequency, and their quantity).<\/p>\n

      Example FortiAP settings\"Cisco\"Cisco<\/p>\n<\/p>\n

      4) The next step \u2014 creating the SSID. Navigate to the tab WiFi & Switch Controller > SSIDs > Create New > SSID. <\/em>Here, it is important to configure:<\/p>\n