A customer wants to allow employees to easily onboard their personal devices to the wireless network. The visitors also must be able to connect to…

A self-registration guest portal on Cisco ISE is the most appropriate solution to meet both requirements. This portal type allows visitors to create their own temporary network access credentials without any administrative or helpdesk intervention, directly fulfilling the "without the need to engage with anyone" requirement. For employees, this same portal infrastructure can serve as the entry point for the Bring Your Own Device (BYOD) onboarding process. Employees would connect, be redirected to the portal, authenticate with their corporate credentials, and then be guided through the device registration and provisioning workflow.

A. MAC authentication bypass: This is an authentication method for non-802.1X capable devices (e.g., printers), not a user-facing self-service onboarding process for employees and guests with personal devices.

B. native supplicant provisioning: This is a specific step within the BYOD process to configure a device for 802.1X. It does not address the initial self-service registration for guests.

C. local web auth: This is a simpler authentication method, typically hosted on a WLC or switch, that lacks the built-in self-registration and comprehensive workflow capabilities of an ISE portal.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Guest Access" Chapter

"Guest Types and Portals" section: This section details the different guest portals available in ISE. It explicitly states

"You can configure a guest portal to allow guests to self-register for network access. When a guest connects to the network and opens a browser

the guest is redirected to the Self-Registered Guest Portal." This directly supports the visitor requirement.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Set Up BYOD" Chapter

"BYOD Process" section: This section outlines the BYOD workflow

stating

"The BYOD process begins when a user connects a personal device to the network... The user is redirected to a portal where they enter their username and password." This confirms that a portal is the starting point for employee self-onboarding.

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Authentication Policies" Chapter

"MAC Authentication Bypass" section: The documentation describes MAB as a fallback mechanism for endpoints that do not support the 802.1X protocol. This clarifies that it is not a primary self-service portal solution for user devices like smartphones and laptops.