Preventing endpoints who join guest network to get access to corporate network

[berossig]

Hi,

I have a customer who wants to prevent any corporate devices who may have access the guest network from coming back to the corporate network. I.E automatically put the MAC address in a group and use it as a condition to completely restrict them access to the corporate network as soon as they have been connected to the Guest network. Pretty similar to blacklisting actually.

So my question is can it be easily done? And if you can give some hints on how we can achieve it, it would be a great help!

thanks in advance.

Regards,

[Jason Kunst · Accepted solution]

why couldn't you say if guest endpoints in front of all your rules for corporate? then deny and send to a portal that says why? See on public ISE community under guest how to do this hotspot as a message portal

another option is to say if corporate MAC address then deny access to guest network