topic Re: ISE Guest with OpenDNS in Network Access Control

ISE Guest with OpenDNS

joshhunter — Thu, 28 Apr 2016 12:51:37 GMT

Hello, is anyone using OpenDNS for their DNS as Guest content filtering with ISE?

The only problem I envisage is that we want to use a wildcard certificate to prevent certificate warning in browsers.

So this means users need to resolve the DNS name of ISE guest portal to the internal IP as part of the re-direct process.

Re: ISE Guest with OpenDNS

gbekmezi-DD — Thu, 28 Apr 2016 15:48:53 GMT

Is there a reason you don't want to publish the ISE guest portal A record to external DNS?

Re: ISE Guest with OpenDNS

joshhunter — Thu, 28 Apr 2016 15:59:29 GMT

Hi George, I have had a look at OpenDNS free package and there does not appear to be a way to add an A record.

Have you any information on this?

I want the benefits of content filtering the guest using OpenDNS but for the ability to resolve the ISE Guest Portal IP.

Re: ISE Guest with OpenDNS

gbekmezi-DD — Thu, 28 Apr 2016 16:48:39 GMT

You still have to publish DNS records using whatever method your organization or your customer's organization does for other records. For example, if my domain is bekmezian.com I go to my DNS configuration (for me it's WebKor) and I add a record for guest.bekmezian.com. Nothing to do in OpenDNS except for ensure you don't Block internal IP addresses (screenshot attached):

Re: ISE Guest with OpenDNS

joshhunter — Thu, 28 Apr 2016 19:10:20 GMT

Hi George, Are you suggesting you add an 'A record' that maps to a private ip on a public DNS?

So, lets say for example I own the domain of isecold.com and I have a wildcard certificate that is allows for *.isecold.com

I would then add a public DNS entry for example for guest.isecold.com to my private IP address (ISE Guest Portal IP).

That way my guests can still use opendns and resolve guest.isecold.com and SSL certicate would work.

The only thing that may prevent this is if my Domain/DNS provider would not allow a private IP.

I've read a few different forums with many suggesting this is bad practice even if you provider does allow it.

Thanks

Re: ISE Guest with OpenDNS

gbekmezi-DD — Thu, 28 Apr 2016 19:36:09 GMT

That's exactly what I am suggesting Josh. If you know what you are doing and why you are doing it, then you are free to bend rules. If the requirement is "point my guests to opendns" then that is your only option. The other option you could consider is having your guests point to a DNS forwarder in your own network. Then your DNS server could resolve your own domain locally while forwarding all other requests to opendns' name servers.

George

Re: ISE Guest with OpenDNS

joshhunter — Thu, 28 Apr 2016 19:41:56 GMT

or possibly the Internet Firewall can inspect client DNS requests and intercept.

Thanks George.

Re: ISE Guest with OpenDNS

joshhunter — Tue, 03 May 2016 23:15:37 GMT

Worked perfectly George as you suggested.

Thanks