Auto provision AD accoutns for wireless auth?

Berg0

[H]ard|Gawd
Joined
May 16, 2005
Messages
1,038
Hi all,

bit of an odd question here. We're doing a small wireless rollout (4 cisco lightweight AP's and two 1130's in lightweight mode on a 6-port Cisco wireless controller) You'll have to excuse my unfamiliarity with the equipment, as I've only really done wireless config on an 871W and a standalone 1130 AP.
There will be two VLANs accessible by wireless users. One VLAN will be private and have a single SSID, users will auth with their AD creds so long as they are a member of the appropriate security group. The other VLAN with have two SSIDs and be the guest access, with ACL's preventing access to any internal resources, basically they just have internet access. One SSID for our employees to connect personal devices or whatever, and will use AD creds to auth, and the other SSID will be for actual guests. This is where I get a bit lost. the desired function is to have 5-10 accounts with expiry dates. I want people in our "receptionist" security group to be able to provision accounts for guests to connect to our wireless network. They would use AD creds of one of these 5-10 accounts to connect.
I need a solution to have our secretary "hit a button" and have the expiry date of an expired account in the appropriate ou extended, and to reset the password to a randomly generated password that they will provide to the guest.
Anyone done something like this before? if there is some software floating about to do it, cool. If not, i"ll end up writing a powershell script or vb script or something to do it.
 
Have you looked at a captive portal for your guest only wireless?

I don't know of a prepackaged solution but i'm sure a bit of .net can make it happen.
 
Which Cisco wireless controller are you using? The 'hit a button' and generate an expiring guest account login is a function of Cisco's WLCs and works very well for the scenario you describe. I would strongly suggest skipping the active directory solution and use Cisco's built in guest access provisioning. Everything can still get logged in detail if that is a requirement.

edit: looks like the 2106 is what you are using.
 
Last edited:
Back
Top