---
title: Setup Wired Secured Guest with Wired SSO
slug: setup-wired-secured-guest-with-wired-sso
createdAt: 2026-11-02T18:12:17.681Z
---

## Overview

Use Wired Secured Guest with Wired SSO when visitors and employees need to join the wired network through the same captive portal. Visitors sign in as guests. Employees choose the SSO option on the same portal page, sign in with your identity provider (IdP), and move to the post-authentication segment.

A device starts in the built-in guest segment, which acts as the pre-authentication segment. Nile manages this segment and its DHCP scope, so you do not need to create them. The device passes through SAML SSO and then moves to the post-authentication segment.

![](https://api.archbee.com/api/optimize/6swSwg1BT-BlfEPtYJhxM/LocjF8X-J6OO9dxIfOTpm_guest-access-flow-diagram-a1c5fae57a884c4eaeece671baf65031.png)

This option is available only when Nile Guest Service is enabled. If it is not enabled, the **Wired Secured Guest & SSO** tab and its toggles do not appear. To set up only one of the two, see Setup Wired Secured Guest or Setup Wired SSO.

## Prerequisites

Complete the following before you turn on both options. Each step has a dedicated page with detailed instructions.

- **Configure a Service Area.** Define the sites, buildings, and floors where you need Nile connectivity. See [Setup Service Areas.](docId\:M0t6wvhGlM1aU6ECyhJ10)
- **Configure SSO.** Integrate your identity provider (IdP) with Nile. See Okta, Microsoft Entra ID, or Google Workspace.
- **Configure DHCP.** Create separate DHCP pools for the pre-authentication and post-authentication SSO segments. Refer to [Setup DHCP](docId\:yF0RQ3chVX1tCLBSyaMV7) for configuration details.
- **Configure Segments.** Create a pre-authentication segment that uses the short-lease pool, and choose the post-authentication segment, such as your existing employee segment. Ensure that you use the pre-authentication segment only for Wired SSO, and not for another other rules like OUI or fingerprint. See [Setup Segments.](docId\:PEbVdf0dbCBqaExUuX6Af)

## Configuration Steps

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Access Management**, and open the **Wired Secured Guest & SSO** tab.
3. Turn on both the **Wired Secured Guest** and **Wired SSO** toggles.
4. Configure the following:
   - **Wired Secured Guest:** The built-in guest segment (**GuestPopNetworkSegment**) is used as the pre-authentication segment. This segment cannot be changed.
   - **Post-authentication:** Select the destination segment after login, for example, your employee segment.
5. Click **Save**. Click **Reset** to discard unsaved changes.

To turn off either option later, switch its toggle off and click **Save**.

## What users see

- **Visitors:** Sign in as guests on the captive portal, using the guest portal type set on the Nile Guest Service guest SSID, and get guest Internet access.
- **Employees:** Choose the SSO option on the same portal page, sign in with the IdP, and move to the post-authentication segment.

## Behavior

### Guest behavior

- **Unmatched devices:** A device that matches no other rule joins the guest segment and is sent to the captive portal.
- **Isolated traffic:** All guest traffic is directed to a Nile PoP and kept separate from corporate traffic.
- **Shared guest settings:** Changes to the guest SSID apply to both wireless and wired guests.
- **Replaces Allow all MACs:** Only one of Allow all MACs, Wired Secured Guest, or Wired SSO can be active at a time. If you already have an Allow all MACs rule, review your setup before you turn on Wired Secured Guest.
- **IP address planning:** Any device that plugs in and is not matched by another rule gets an address from the guest segment. Size your guest address space for the devices that can connect.

### SSO behavior

- **Scope:** Wired SSO applies at every location where these segments are used. It cannot be turned on for only some locations.
- **Devices without a browser:** Printers, sensors, and similar devices cannot sign in. Approve them manually, add a fingerprint rule, or let users register them through the self-registration portal.
- **Later connections:** After a successful sign-in, the device is added to the MAC authentication table, and later connections do not ask for sign-in again.
- **When sign-in is required again:** The device has not been on the network (wired or wireless) for 30 days, it appears on a different port than before, or the user changes the password in the IdP.
- **Segment after sign-in:** If the user has signed in on wireless before, the device joins the same segment. Otherwise, it joins the post-authentication segment.
- **Returned laptops:** Delete the device's entry from the **Wired** table to force sign-in again.
- **Session status:** The device list shows SSO states such as **SSO Initiated**, **SSO Pending**, **SSO Approved**, **SSO Denied**, and **SSO Session Expired**.