---
title: Setup Wired Secured Guest
slug: setup-wired-secured-guest
createdAt: 2026-10-22T19:29:01.722Z
---

## Overview

Wired Secured Guest lets visitors and unknown devices join the wired network through a captive portal. A device that is not approved by another rule joins the guest segment and is sent to the captive portal. After the user completes the portal, the device gets guest Internet access.

All guest traffic is directed to a Nile PoP, which keeps it separate from corporate traffic. You can use Wired Secured Guest on its own. An identity provider (IdP) and SSO are not required.

Wired Secured Guest is part of Nile Guest Service. You configure the guest portal once on the Nile Guest Service guest SSID, and the same settings apply to both wireless and wired guests.

To let employees also sign in with your IdP on the same portal page, see Setup Wired Secured Guest with Wired SSO.

## Prerequisites

- **Subscribe to Nile Guest Service.** Wired Secured Guest is available only when Nile Guest Service is enabled. After you subscribe, Nile creates the guest segment, including its DHCP server and client subnets, and a guest SSID named **Nile**. See [Nile Guest Service.](docId\:fM6eJ6b-Nof3ZKSmVOt-0)

## Configure the Guest Portal

Set the guest portal type and other guest settings on the guest SSID. This is the same SSID that wireless guests use, so changes apply to both wireless and wired guests.

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Wireless**.
3. In **Wireless Services**, find the guest SSID (named **Nile** by default) and click the pencil icon to edit it. A red exclamation mark next to the name shows that the SSID still needs to be configured.
4. On the **Guest service** tab, set the following:
   - **Name**: Enter the SSID name that guests will see, for example, Company-Guest.
     - **Guest Authentication Option**: Select the guest portal type. See the table below.
     - **DNS server 1** and **DNS server 2**: The defaults are 8.8.8.8 and 8.8.4.4. Keep them, or enter your own DNS servers.
     - **Guest session timeout**: Enter a number and select the unit, such as **Hours**. The default is 24 hours.
     - **Walled Garden**: Optional. Click **Add** to list websites that guests can reach before they log in.
     - **Terms and Conditions**: Expand this section and enter your terms in the editor.
5. **Optional:** Open the **URL filtering** tab and the **Advanced** tab to control which websites guests can visit.
6. Click **Save**. To discard your changes, click **Cancel**.

| Guest Authentication Option | How guests connect                                                                                        | Best for                                   |
| --------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| Click through               | Guests accept your terms and conditions.                                                                  | Open guest access with the simplest login. |
| Email approval              | Guests request access, and an employee approves it by email.                                              | Employee-hosted visitors.                  |
| Access Code                 | Guests enter a code that the admin created. The code can be shared by all guests or unique to each guest. | Events, conferences, and managed visits.   |
| SMS - Access Code           | Guests enter a phone number and receive a one-time code by SMS.                                           | Guests who need quick self-service access. |

Each option has its own extra settings, such as sponsors for email approval or access codes. For the full steps for each option, URL filtering, and guest page branding, see Setup Nile Guest Access Service.

## Turn On Wired Secured Guest

1. Log in to the Nile Portal.
2. In the left navigation, select **Network Setup > Access Management**, and open the **Wired Secured Guest & SSO** tab.
3. Turn on the **Wired Secured Guest** toggle.
4. Leave the **Wired SSO** toggle off.
5. Confirm that the built-in guest segment (**GuestPopNetworkSegment**) is used. This segment cannot be changed.
6. Click **Save**. 

After you save, unmatched devices join the guest segment and are sent to the captive portal. No IdP or SSO is involved.

To turn off Wired Secured Guest later, switch the **Wired Secured Guest** toggle off and click **Save**.

## Wired Secured Guest behavior

- **Unmatched devices:** A device that matches no other rule joins the guest segment and is sent to the captive portal.
- **Shared guest settings:** The captive portal uses the guest portal type and settings from your Nile Guest Service SSID. Changes you make there apply to both wireless and wired guests.
- **Isolated traffic:** All guest traffic is directed to a Nile PoP and kept separate from corporate traffic. You do not need to create a segment or DHCP scope for it.
- **Devices without a browser:** Any device that connects to the network and does not match an existing classification rule will be assigned an IP address from the guest segment by default. This includes printers, sensors, and other similar devices that cannot complete the captive portal authentication process. Ensure each device is assigned to the appropriate network segment using identification criteria such as MAC address, OUI, device fingerprint, or switch hostname and port rules. Additionally, ensure the guest IP address pool is sufficiently sized to accommodate all devices that may connect to the network.
- **Replaces Allow all MACs:** If you already have an Allow all MACs rule, review your setup before you turn on Wired Secured Guest.