topic Re: ISE distributed and guest portals in Network Access Control

ISE distributed and guest portals

Tmsna — Fri, 12 Jul 2019 09:22:11 GMT

Hi Guys,

We are planning to deploy two ISE servers with sponsor portal and BYOD.

My question is how the sponsor portal and mydevices portal should work.

Can this configuration be achieved without using any load balancer for DNS?

Also how should I configure the CN and SAN in the public certificate?

Thanks,

Albert

balaji.bandi — Fri, 12 Jul 2019 11:41:31 GMT

there is good documentation for reference here : (let us know if you stuck any where while configuring ) ?

Tmsna — Fri, 12 Jul 2019 11:59:48 GMT

Hi Balaji,

Thanks for the link.

Unfortunately I don't see anything related to a distributed environment.

Regards,

Albert

Jason Kunst — Fri, 12 Jul 2019 14:15:21 GMT

I would recommend looking at the Prescriptive Guest guide at http://cs.co/ise-guest and admin guide

They go over DNS, how the sponsor portal work with easy URL FQDN and DNS. My devices works similar. Every PSN will serve these portals.

examples:

Using a sponsor portal

If you want to look at redundancy information, check out BRKSEC-3432 it has slides discussing. Load balancing for these portals as well.

Make sure you mark answers as helpful or solutions please

Tmsna — Tue, 16 Jul 2019 14:44:21 GMT

sorry but I still don't get how this should work.

I have my sponsorportal pointing to one PSN. If this PSN goes down, what is the best way to change the DNS resolution?

Using a load balancer for DNS?

balaji.bandi — Tue, 16 Jul 2019 15:11:15 GMT

If the PSN have configured Failover Option, and other PSN Configured Same Entry for the portable it should be able to redirect to same

portal.

you need to Loabalance on the Portal side, if the one Web Server go down, another one should take over.

make sense ?

Jason Kunst — Tue, 16 Jul 2019 21:07:22 GMT

The best way is to use round robin DNS for a basic setup. Otherwide you can put PSNs behind a loadbalancer. check out http://cs.co/ise-scale resources and there is a link to BRKSEC-3432 slides going over that.
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-118574828
Also you can check out the F5 LB document for more details on implementation
https://community.cisco.com/t5/security-documents/how-to-cisco-amp-f5-deployment-guide-ise-load-balancing-using/ta-p/3631159