The following restrictions are applicable when running Cisco TrustSec in enforcement mode or inline tagging mode. These restrictions do not apply when these switches are used as an SXP speaker:
- An IP subnet address cannot be statically mapped to a Security Group Tag (SGT).
- If a port is configured in multi-authentication mode, all hosts connecting to that port must be assigned the same SGT.
- Cisco TrustSec enforcement mode on a VLAN trunk line supports only up to eight VLANs. If more than eight VLANs are configured on a VLAN trunk link and Cisco TrustSec is enabled on those VLANs.
https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/sxp_conf ig.html#Restriction%20for%20SGT%20Exchange%20Protocol

https://www.cisco.com/c/en/us/td/docs/security/ise/2-
1/install_guide/b_ise_InstallationGuide21/b_ise_InstallationGuide21_chapter_011.html

The sponsored guest portal must first be created so that Cisco ISE has a portal object whose authentication, customization, and authorization settings can be configured. After creation, the engineer configures the Sponsor Change Password Settings option, which defines whether sponsored users must change an assigned password and controls related credential behavior. The Post-Login Banner Settings page is then configured to determine the information displayed after successful guest authentication. Finally, the sponsored guest portal must be authorized through the applicable Cisco ISE authorization profile and policy rule so that matching guest sessions are redirected to or permitted through the portal. Authorization cannot logically occur before the portal exists. The sequence therefore follows object creation, credential configuration, user-interface customization, and policy enforcement: D, B, C, and A.

http://www.network-node.com/blog/2016/1/2/ise-20-profiling