Setup Wired Secured Guest
Overview
Wired Secured Guest lets visitors and unknown devices join the wired network through a captive portal. A device that is not approved by another rule joins the guest segment and is sent to the captive portal. After the user completes the portal, the device gets guest Internet access.
All guest traffic is directed to a Nile PoP, which keeps it separate from corporate traffic. You can use Wired Secured Guest on its own. An identity provider (IdP) and SSO are not required.
Wired Secured Guest is part of Nile Guest Service. You configure the guest portal once on the Nile Guest Service guest SSID, and the same settings apply to both wireless and wired guests.
To let employees also sign in with your IdP on the same portal page, see Setup Wired Secured Guest with Wired SSO.
Prerequisites
- Subscribe to Nile Guest Service. Wired Secured Guest is available only when Nile Guest Service is enabled. After you subscribe, Nile creates the guest segment, including its DHCP server and client subnets, and a guest SSID named Nile. See Nile Guest Service.Nile Guest Service.
Configure the Guest Portal
Set the guest portal type and other guest settings on the guest SSID. This is the same SSID that wireless guests use, so changes apply to both wireless and wired guests.
- Log in to the Nile Portal.
- In the left navigation, select Network Setup > Wireless.
- In Wireless Services, find the guest SSID (named Nile by default) and click the pencil icon to edit it. A red exclamation mark next to the name shows that the SSID still needs to be configured.
- On the Guest service tab, set the following:
- Name: Enter the SSID name that guests will see, for example, Company-Guest.
- Guest Authentication Option: Select the guest portal type. See the table below.
- DNS server 1 and DNS server 2: The defaults are 8.8.8.8 and 8.8.4.4. Keep them, or enter your own DNS servers.
- Guest session timeout: Enter a number and select the unit, such as Hours. The default is 24 hours.
- Walled Garden: Optional. Click Add to list websites that guests can reach before they log in.
- Terms and Conditions: Expand this section and enter your terms in the editor.
- Optional: Open the URL filtering tab and the Advanced tab to control which websites guests can visit.
- Click Save. To discard your changes, click Cancel.
Guest Authentication Option | How guests connect | Best for |
|---|---|---|
Click through | Guests accept your terms and conditions. | Open guest access with the simplest login. |
Email approval | Guests request access, and an employee approves it by email. | Employee-hosted visitors. |
Access Code | Guests enter a code that the admin created. The code can be shared by all guests or unique to each guest. | Events, conferences, and managed visits. |
SMS - Access Code | Guests enter a phone number and receive a one-time code by SMS. | Guests who need quick self-service access. |
Each option has its own extra settings, such as sponsors for email approval or access codes. For the full steps for each option, URL filtering, and guest page branding, see Setup Nile Guest Access Service.
Turn On Wired Secured Guest
- Log in to the Nile Portal.
- In the left navigation, select Network Setup > Access Management, and open the Wired Secured Guest & SSO tab.
- Turn on the Wired Secured Guest toggle.
- Leave the Wired SSO toggle off.
- Confirm that the built-in guest segment (GuestPopNetworkSegment) is used. This segment cannot be changed.
- Click Save.
After you save, unmatched devices join the guest segment and are sent to the captive portal. No IdP or SSO is involved.
To turn off Wired Secured Guest later, switch the Wired Secured Guest toggle off and click Save.
Wired Secured Guest behavior
- Unmatched devices: A device that matches no other rule joins the guest segment and is sent to the captive portal.
- Shared guest settings: The captive portal uses the guest portal type and settings from your Nile Guest Service SSID. Changes you make there apply to both wireless and wired guests.
- Isolated traffic: All guest traffic is directed to a Nile PoP and kept separate from corporate traffic. You do not need to create a segment or DHCP scope for it.
- Devices without a browser: Any device that connects to the network and does not match an existing classification rule will be assigned an IP address from the guest segment by default. This includes printers, sensors, and other similar devices that cannot complete the captive portal authentication process. Ensure each device is assigned to the appropriate network segment using identification criteria such as MAC address, OUI, device fingerprint, or switch hostname and port rules. Additionally, ensure the guest IP address pool is sufficiently sized to accommodate all devices that may connect to the network.
- Replaces Allow all MACs: If you already have an Allow all MACs rule, review your setup before you turn on Wired Secured Guest.