Lobby Ambassador - WCS Logging of Guest Account Creation

Hello all,
If I am user "admin-ken" and I setup an guest user account "guestuser1" via the WCS controller templates > Guest User (which takes me into lobby ambassador), is there a log file that indicates that "admin-ken" had setup "guestuser1" guest account?
Many thx indeed,
Kind regards,
Ken

HiKen,
Hope all is well :)
Maybe this is what you are looking for;
Logging the Lobby Ambassador Activities
The following activities are logged for each lobby ambassador account:
â¢Lobby ambassador login: WCS logs the authentication operation results for all users.
â¢Guest user creation: When a lobby ambassador creates a guest user account, WCS logs the guest user name.
â¢Guest user deletion: When a lobby ambassador deletes the guest user account, WCS logs the deleted guest user name.
â¢Account updates: WCS logs the details of any updates made to the guest user account. For example, increasing the life time.
Follow these steps to view the lobby ambassador activities.
Note You must have superuser status to open this window.
Step 1 Log into the Navigator or WCS user interface as an administrator.
Step 2 Click Administration > AAA, then click Groups in the left sidebar menu to display the All Groups window.
Step 3 On the All Groups windows, click the Audit Trail icon for the lobby ambassador account you want to view. The Audit Trail window for the lobby ambassador displays.
This window enables you to view a list of lobby ambassador activities over time.
â¢User: User login name
â¢Operation: Type of operation audited
â¢Time: Time operation was audited
â¢Status: Success or failure
Step 4 To clear the audit trail, choose Clear Audit Trail from the Select a command drop-down menu and click GO.
http://www.cisco.com/en/US/docs/wireless/wcs/4.2/configuration/guide/wcsmanag.html#wp1076868
http://www.cisco.com/en/US/docs/wireless/technology/guest_access/technical/reference/4.1/GAccess_41.html#wp1001609
Hope this helps!
Rob

Similar Messages

WCS logs for Guest accounts

Hello,
Are there any logs on the WCS that can capture the MAC and IP address of a Guest client ?
The idea is to have this information available in order to correlate it with the Web server logs. It seems that the WCS logs capture only the MAC address
of a Guest client.
Are you aware of any settings for any logs that would enable logging of both the IP and MAC address for guest accounts ?
Thank you in advance
Best Regards,Pan

In 5.2 take a look at the guest user session report:
http://www.cisco.com/en/US/docs/wireless/wcs/5.2/configuration/guide/5_2reps.html#wp1117029
Guest User Sessions Report
The Guest User Sessions report shows historical session data for a guest user such as amount of data passed, login and logout time, the guest IP address, and the guest MAC address.
The session data is available (by default) for one month after the session event occurs. This data retention period is configurable from the WCS background task settings page.
This report can be generated for guest users who are associated to controllers running software version 5.2 and above.

Lobby Ambassador can't email guest user accounts via WCS

WCS is configured with SMTP server under Administration-Settings-Mail Server Configuration and test is successful and it sends e-mail alerts out no problem. However, when Lobby Ambassador creates a new guest account and clicks on the e-mail link to email it out, this message pops-up: 'Email Server is not configured.Contact Network Administrator'.
Any ideas?

by poking around I've found an answer. Even though we have a single email server, right after I've added the same server as a secondary email server, notifications started working. Seems to be a WCS bug.

Lobby Admin for guest account creation - Automation of account creation

hello all,
i'm sure the creation of guest accounts on the lobby admin page is a painful process for all involved - for us, it involves a process like this:
visitor asks for wifi > receptionist phones IT > IT creates account> IT phones receptionist with login details.
I would like to know whether it's possible to speed up this process either:
1) receptionist is able to click a few buttons, type the name of a visitor (so we know who used particular the guest ID), then is able to generate an ID and password immediately, which can then be printed onto a ticket printer of some sort.
2) visitor simply connects into the guest network, has to register (name and email) and automatically gets connected.
are any of these possible? or any other option I could take?
Thanks

Why not just have the receptionist create the account via the Lobby Admin login? The point of Lobby Admin is such that an elevated end-user (receptionist/security/etc) can log in to create a guest account without having to interact with an "admin". There's no point in having your IT staff handle the Lobby Admin logins.
Some of the other items you are asking for would be a better use-case with Cisco ISE solution.

Guest account creation in ISE

Hello All,
I am encountering an issue in which I find only when guest accounts are created by sponsor through the sponsor portal, guess access is granted. If I manually add guest account in the same guest role via the administrative UI, instead of guest access authz profile is hit, ISE goes through supplicant provisioning flow. I know that I do have enable self provisioning flow but why would it kick in for guest user created by admin? I see many bugs dealing with guest portal flows but failed in finding one exactly matching to my senario. Any insight is greatly appreciated. version 1.2.
Fadi

You can create and manage guest user accounts to provide temporary network access for guests. If you have numerous guest user accounts whose account information is stored in an external database, you can import this information to expedite the account creation process.
Please Check the below guide for user’s creations:
http://www.cisco.com/en/US/docs/security/ise/1.1/sponsor_guide/ise_sponsor_chp2.html

ISE Guest Email Notification (Guest account creation)

When a guest user creates an account in ISE, it sends a system generated email with the username/password. It says "Welcome to the Guest Portal, your username ise xxx and password is yyy." Is there anywhere in ISE (1.2) to change this text, especially the name 'Guest Portal'? I thought it was in language templates > Configure Miscellaneous Items > Portal Name. But I changed this to the portal name, and it was not reflected in the email. Thanks.

Josh,
Right now, it's pretty limited. Here is the template to be used for formatting the email notifications:
E-Mail Notification Template
The following is an example of the login information for the body of an e-mail in an English language template:
Welcome to the Guest Portal, your username is $username$ and password is $password$
The $username$ and $password$ strings will be replaced with the username and password values from the Guest User account.
In the e-mail body, you can use special variables to provide the details for the created guest account. When using these variables, you must use all uppercase or all lowercase letters, and you cannot mix them. For example, the string for username can be either $USERNAME$ or $username%, but it cannot be $UserName$.
You can use these variables in the e-mail notification template:
•$USERNAME$ = The username created for the guest.
•$PASSWORD$ = The password created for the guest.
•$STARTTIME$ = The time from which the guest account will be valid.
•$ENDTIME$ = The time at which the guest account will expire.
•$FIRSTNAME$ = The first name of the guest.
•$LASTNAME$ = The last name of the guest.
•$EMAIL$ = The e-mail address of the guest.
•$TIMEZONE$ = The time zone of the user.
•$MOBILENUMBER$ = The mobile number of the guest.
•$OPTION1$ = Optional field for editing.
•$OPTION2$ = Optional field for editing.
•$OPTION3$ = Optional field for editing.
•$OPTION4$ = Optional field for editing.
•$OPTION5$ = Optional field for editing.
•$DURATION$ = Duration of time for which the account will be valid.
•$RESTRICTEDWINDOW$ = The time window during which the guest is not allowed to log in.
•$TIMEPROFILE$ = The name of the time profile assigned.
This dicument is found here:
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_custom_portals.html#wp1015657
ISE v1.3 should have some improvements and quite possibly some HTML tags.
Charles Moreton

Automate Guest account creation?

I need to create multiple users for guest wifi (+200) using the Lobby Admin account, is there a way to either create a template, csv file, or any other way to automate this and import it into the WLC as opposed to creating each account individually?

I don't really know of any way to script it, but using Microsoft Excel with your CSV files, you could quickly create users via the CLI.
1) SSH into your WLC.
2) Enter: show wlan summary
3) Find the WLAN ID of your guest WLAN
4) Type 'config' to get into config mode.
5) Prep these commands using excel, one line for each user, fill in the < > with your CSV columns.
Command:
netuser add wlan userType guest lifetime description ""
Example:
(Cisco Controller) config>netuser add Jimbo 100%Cisco wlan 2 userType guest lifetime 0 description "Jimbo's Guest Account"
Once you have all your single line commands created in Excel, CLI into your WLC and copy all of your lines of new accounts and simply paste once :) It will quickly create all of your accounts.
netuser add George 100%Cisco wlan 2 userType guest lifetime 0 description "Guest Account 1"
netuser add Henry 100%Cisco wlan 2 userType guest lifetime 0 description "Guest Account 2"
netuser add Suzy 100%Cisco wlan 2 userType guest lifetime 0 description "Guest Account 3"
It should create them all in a snap.
Good Luck,
Lucas

Logging into guest account requires network key?

Airport Extreme guest account login from my Windows XP laptop requires a network key and not a password as I expected. Anyone know why and how to fix this? Thank you.

Everything up to date on the XP machine?
If you are using WPA2 Personal, or WPA/WPA2 Personal security on the Guest Network, then your normal "password" of 8 characters or more should work.
If the XP machine really does require the "key", which is a long code of numbers and letters, you can locate that on your Mac as follows:
Open Macintosh HD > Applications > Utilities > AirPort Utility
Click Manual Setup
Do NOT look at the AirPort Utility window in the center portion of the screen
Look up to the very top of the computer screen to locate the AirPort Utility menu items to the right of the Apple icon
Click the Base Station menu
Click Equivalent Network Password and the "key" will be displayed for both your "main" and "guest" networks
You might want to note that when you enable the Guest Network, the bandwidth is split between your Main and Guest Networks, so you would only want to enable the Guest Network when you really have "guests"

Lobby Ambassador- Guest User Creation

Hi all,
I am currently implementing the use of the lobby ambassador for guest account creation, however I am looking to see if some features exist. I would like to be able to tie into AD to create lobby ambassador's to have further control of who can and cannot create guest accounts. I am also looking if there is a way to put restrictions on the time frame a guest account can remain active for when created by the lobby ambassador. An example of what I am trying to do is to not have a guest account created by an ambassador to go over a day for it's time frame.
Thanks in advance,
Chris

Yes and yes. From WCS you can pull the role for lobby admin and use that to create the group with the proper attributes.
Then on the WCS you build the template you want them to use. There you can create the restrictions of how long.
Steve
Sent from Cisco Technical Support iPhone App

WCS - Guest User Creation

Hello. I have a question related to the Lobby Ambassador login in WCS and creating user accounts in an environment using a guest Anchor controller. Specifically, if a 'lobby ambassador' is logged into WCS from 2 timezones away (anchor is in same location as WCS) creating a user, they will see the local time of the WCS (for start/stop times), correct? Is there a way to make it present the local time to the lobby ambassador so they don't have to figure out the correct start/stop times for their location?
Hopefully this question makes sense.
Thank you for your time and assistance,
Jeff

Lobby admins created guest users are always in the WCS timezone. If controllers are in another timezone, the lobby admin needs to adjust the time accordingly while creating guest users.

Lobby Ambassador Profiles in ACS 5.3

We've set our WCS up to do AAA through our ACS 5.3 which works great. So in order to log into the WCS for Administration or as a Lobby Ambassador (to create guest users etc) the AAA is all done by the ACS, GREAT!
I have assigned a set of users the Lobby Ambassador role as passed that back through TACACS to the WCS, so those users have their role setup as Lobby Ambassador and are limited from doing anything else, as expected.
What I want to know is: With normal local AAA on the WCS, when you created a Lobby Ambassador account, you could give the account a set of defaults for any guests accounts created by that Lobby Ambassador account, which was good, so Lobby Ambassadors couldn't set up unlimited time accounts and stuff like that.
What I want to know now is that since I'm now doing all the AAA on the ACS, is there an attribute I can pass to the WCS in the Shell Profile, along with the roles etc telling the WCS what the guest user creation defaults for the Lobby Ambassador account is, so that we can continue to limit the defaults of any guest account that the Lobby Ambassador accounts create, as it used to be? We'd really like different lobby ambassadors to be able to do different things as well. i.e., Lobby Ambassador X can only create accounts for one region. Lobby Ambassador Y can create Unlimited time accounts where the others can not. We used to do this by assigning different guest user creation defaults to different lobby ambassador accounts on the WCS.
Help appreciated

Hi,
at the moment the only solution for your requirement is to create local NCS/WCS accounts with exactly the same username as existing in your ACS, no matter what password. Authentication will happen via TACACS+ while the defaults will be taken from the local user account. Please be aware that this mechanism is case sensitive.
Regards
Stefan

Notifications before or when a guest account expires

Hello,
I have the WCS to create guest user accounts from Lobby Ambassador WCS role. Till now, we set limited duration of the guest user accounts which expire automatically when that duration is reached.
My question: is it possible to configure notifications so that we are warned when the guest user accounts are removed ? Ideally, it would be even better to be warned before the guest user accounts expire.
Is that possible ?
Thanks a lot,
David

I guess we do not have this feature yet!! i request you to contact your acconts team and please feel free to raise a Product Enhancement Request (PER)..
Lemme know if this answered ur question and please dont forget to rate the usefull posts!!
Regards
Surendra

New to Cisco Lobby Ambassador

I want to be able to tie the registering users into the visitor registration section of a segregated guest network. I want to have a link that would appear in the front end after you register a visitor which would direct you to this program which is the lobby ambassador. Any non guest user could be able to register a guest and be provided a temp logon for the guest for a period of time.
Anyone has an idea of how I can achieve this using a Cisco lobby ambassador

You should be able to expand it to something bigger. On the controller go to Security, AAA, General. Increase this number, it will require a reboot. I'm not sure the maximum you can increase it to (could be controller dependent).

ISE1.1 - Use of one guest account on multiple devices

I have ISE1.1 with local web authentication process for "Guest" Wi-Fi. I faced a problem in bulk guest account creation and TAC filed a bug - CSCup38457: "importing guest account CSV fails via sponsor portal"
Now, I need to allow guests to connect to "Guest" Wi-Fi using multiple devices (approx. 200). My queries are below:
1- Is it possible to permit one guest account to be used by approx. 200 devices at same time?
2- On how many devices single guest account can be used?
3- Is there any limitation or abnormal behavior in terms of guest portal for such cases?

Are you sure that is true?
When I look at the restriction on device registration I read that as applicable only to Device Self Registration, not to normal guest access.
So as far as guest sessions per user I can either choose to limit to one with the check box, or allow infinite.
And the Device Registration Portal Limit applies to self registration of devices, not just standard guest access. The OP doesn't look like he wants to register devices, he just wants to allow guest access for multiple devices.
This is how I read it anyway. Please let me kno if you think otherwise.
If this is not the case, then is it not possible to create a standard Network Access User (not through guest portal) and have as many users access this as you need? In this case 200. As long as you disable password changes/expirations/lockouts etc.
If not I may be in trouble :-)

WCS - Lobby Ambassador users don't see each other's guest users

Hi, we currently have the problem with WCS 5.2 that a user of the group "Lobby Ambassador" cannot see guest users that have been created by another user of that group. The user can only see his own created guest users. All are in the same virtual domain which is the root-domain.
I believe this behaviour was not this way in previous versions, here all guest users were visible to all Lobby Ambassador users.
I couldn't find any hint in the documentation about this.
Is this simply a change in behaviour (works as designed) or is this maybe a bug?

You will get this error:
Error(s): You must correct the following error(s) before proceeding:
Error:A Guest User account with the name ''lobby user'' has already been created by you or another WCS Lobby Ambassador user. Please choose a different User Name for this Guest account.

Lobby Ambassador - WCS Logging of Guest Account Creation

Similar Messages

Maybe you are looking for