ISE Guest re authentication

[Leonardo Pena Aristizabal]

Hello Community,

I have a customer that wants guest users expire be blocked for some time (one day) after that time they get authorize to reauthenticate again through the captive portal.

It’s possible?

Thanks a lot

[Leonardo Pena Aristizabal]

x minutes/hours after its last login.

Thanks

[ajc]

I know there is something called ELAPSEDdays for the MAC address in the ISE Endpoint DB. Not sure if there is something called ElapsedHours, let me check

UPDATE: Only the first one. What if you try something like an AUTHZ policy that says:

If Endpoint ElapsedDays equal or greater to 1 day, then CWA

Let's see why you are getting disconnected.

[Francesco Molino]

Yes the only thing possible is in terms of days and not hours.

[Leonardo Pena Aristizabal]

So you think is possible to block a MAC/User within a day?

If yes can you please explain me how?

Thanks.

[Francesco Molino]

Nope, I was answering regarding Elapsed time expressed only in days and not hours.

For your issue, does a user has to sign a AUP? If so, you can maybe play with the condition EndPoints·LastAUPAcceptanceHours and block the user. Usually this is used to force a user re-sign AUP but in your case, you can use it to deny access with the following example:
rule 1: if EndPoints·LastAUPAcceptanceHours is less than 240 accept
rule 2: if EndPoints·LastAUPAcceptanceHours is less than 120 deny

I mean you can play with it and test if it can make working what you're trying to achieve.

[Leonardo Pena Aristizabal]

I think that's the way, let me check.

Thank you very much

[ajc]

I was checking and I got the same as Francesco, via Last AUP Acceptance. The ElapsedDays is only for the Purge Endpoints part.