NAC Guest server allow password change

Question

hi,
  i see there is an option to "allow password change" or "force password change" for guest roles in the NGS. But when i created a guest account using this guest role, after webauthentication , there is no prompt to change password. Is this the intended behaviour or is there anything else that i need to configure. Looking at it, i am not sure how the NGS would allow a "guest user" to really overwrite the password by allowing password change. ? is that not a security risk as well for the NGS ? my setup has 5508 anchor controller and NGS communicating via RADIUS.
regards
Joe

Answer 1

Rob,
We had much the same issue, more around using AD for SSO for sponsors as well as using the NGS as the hotspot. 
The  way around it for us was to have the NGS sit on the inside of the  network, with a FQDN (fully qualified domain name) that had a public IP address to the outside world,  but also a CNAME to an internal address on the inside of the network and  ran NAT on our firewall at the DMZ to link the public and private IP  together. 
The flow looks something like this:-
Wireless Client --> (public IP: NAT'd to private IP) --> Firewall --> NGS on internal network
NGS on internal network <-- (private IP) sponsor
NGS on internal network <-- (private IP) active-directory
The reason we use a CNAME internally is so we can maintain the FQDN which is publically signed by an external CA.
This seems to work ok.  Also the anchor-controller we  have for guest access also has a FQDN assigned to it's virtual interface  which is also publically signed by an external CA. 
This stops all the security pop-ups and provides a more seemless experience to wireless clients associating with the network. 
Security  is taken care of by strictly controlling access to the NGS both on the  anchor controller using ACL's and also on the DMZ firewall.  So if  traffic targetting the NGS comes in from the internet intended for the  NGS from an untrusted/unknown IP range/tcp port then it will not be  permitted.
Hope this makes sense?