topic Re: Guest SSID VLAN to ISE guest service portal IP when guest VLANs are distributed in many countries in Network Access Control https://community.cisco.com/t5/network-access-control/guest-ssid-vlan-to-ise-guest-service-portal-ip-when-guest-vlans/m-p/3420127#M536127 <HTML><HEAD></HEAD><BODY><P>I would suggest to have an ACL not relying on the guest IP address ranges. For example,</P><P></P><PRE __default_attr="plain" __jive_macro_name="code" class="jive_text_macro jive_macro_code _jivemacro_uid_14870165490566435" jivemacro_uid="_14870165490566435"> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Destination&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Source Port&nbsp; Dest Port</P> <P>Index&nbsp; Dir&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address/Netmask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address/Netmask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Prot&nbsp;&nbsp;&nbsp; Range&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Range&nbsp;&nbsp;&nbsp; DSCP&nbsp; Action&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Counter</P> <P>------ --- ------------------------------- ------------------------------- ---- ----------- ----------- ----- ------- -----------</P> <P>&nbsp;&nbsp;&nbsp; 1&nbsp; In&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.1.100.21/255.255.255.255&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 2 Out&nbsp;&nbsp;&nbsp; 10.1.100.21/255.255.255.255&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 3&nbsp; In&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.1.100.10/255.255.255.255&nbsp; 17&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 53-53&nbsp;&nbsp;&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 4 Out&nbsp;&nbsp;&nbsp; 10.1.100.10/255.255.255.255&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17&nbsp;&nbsp;&nbsp; 53-53&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 5 Any&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 6 Any&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any&nbsp; Deny&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> </PRE><P></P><P></P><P>where 10.1.100.21 is the ISE IP address and 10.1.100.10 is the DNS IP address.</P></BODY></HTML> Mon, 13 Feb 2017 20:10:00 GMT hslai 2017-02-13T20:10:00Z Guest SSID VLAN to ISE guest service portal IP when guest VLANs are distributed in many countries https://community.cisco.com/t5/network-access-control/guest-ssid-vlan-to-ise-guest-service-portal-ip-when-guest-vlans/m-p/3420126#M536126 <HTML><HEAD></HEAD><BODY><P><SPAN style="font-size: 11.0pt; color: black;">Is there a best practice or design doc that discusses how to open communication from Guest SSID VLAN to ISE guest service portal IP? That can be challenging when guest VLANs are distributed in many countries.</SPAN></P><P><SPAN style="font-size: 11.0pt; color: black;">Do you open that to go through the internet? Or do you use VPN, VRF etc ?</SPAN></P></BODY></HTML> Mon, 13 Feb 2017 18:34:43 GMT https://community.cisco.com/t5/network-access-control/guest-ssid-vlan-to-ise-guest-service-portal-ip-when-guest-vlans/m-p/3420126#M536126 nmourtzi 2017-02-13T18:34:43Z Re: Guest SSID VLAN to ISE guest service portal IP when guest VLANs are distributed in many countries https://community.cisco.com/t5/network-access-control/guest-ssid-vlan-to-ise-guest-service-portal-ip-when-guest-vlans/m-p/3420127#M536127 <HTML><HEAD></HEAD><BODY><P>I would suggest to have an ACL not relying on the guest IP address ranges. For example,</P><P></P><PRE __default_attr="plain" __jive_macro_name="code" class="jive_text_macro jive_macro_code _jivemacro_uid_14870165490566435" jivemacro_uid="_14870165490566435"> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Destination&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Source Port&nbsp; Dest Port</P> <P>Index&nbsp; Dir&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address/Netmask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address/Netmask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Prot&nbsp;&nbsp;&nbsp; Range&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Range&nbsp;&nbsp;&nbsp; DSCP&nbsp; Action&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Counter</P> <P>------ --- ------------------------------- ------------------------------- ---- ----------- ----------- ----- ------- -----------</P> <P>&nbsp;&nbsp;&nbsp; 1&nbsp; In&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.1.100.21/255.255.255.255&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 2 Out&nbsp;&nbsp;&nbsp; 10.1.100.21/255.255.255.255&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 3&nbsp; In&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.1.100.10/255.255.255.255&nbsp; 17&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 53-53&nbsp;&nbsp;&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 4 Out&nbsp;&nbsp;&nbsp; 10.1.100.10/255.255.255.255&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17&nbsp;&nbsp;&nbsp; 53-53&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 5 Any&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any Permit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>&nbsp;&nbsp;&nbsp; 6 Any&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0.0.0.0/0.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Any&nbsp;&nbsp;&nbsp; 0-65535&nbsp;&nbsp;&nbsp; 0-65535&nbsp; Any&nbsp; Deny&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> </PRE><P></P><P></P><P>where 10.1.100.21 is the ISE IP address and 10.1.100.10 is the DNS IP address.</P></BODY></HTML> Mon, 13 Feb 2017 20:10:00 GMT https://community.cisco.com/t5/network-access-control/guest-ssid-vlan-to-ise-guest-service-portal-ip-when-guest-vlans/m-p/3420127#M536127 hslai 2017-02-13T20:10:00Z