topic Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ? in Network Access Control

Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

damode — Wed, 26 Feb 2020 04:58:14 GMT

I have a client who wants to deploy only single ISE node in their environment for wireless guest access.

Their current DHCP server is configured in AD which is hosted in their datacentre.
They are using Meraki MX devices for wireless
ISE will be part of Corp network.
Their concern is they dont want guest devices accessing the AD server for DHCP/DNS.

In this case, I was wondering if I could use ISE as DHCP and DNS server. But I read in docs that these features exist in ISE for third party NAD devices that dont support dynamic or static url redirection.

So, my question is, even though the client's NAD device would be Meraki, in that case, can I use ISE as DHCP and DNS server ?

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

Mark Elsen — Wed, 26 Feb 2020 08:35:22 GMT

- Basically not as the below thread will confirm : MS-AD is indeed not a good solution for DHCP, better is to look into appliances such as infoblox or others. These can offer extended and flexible configuration for lots of vlan's and subnets.

https://community.cisco.com/t5/network-access-control/ise-with-dhcp-server/td-p/3540467

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

damode — Wed, 26 Feb 2020 08:40:50 GMT

They are already using MS-AD now for DHCP.

The question is whether we can use ISE as DHCP and DNS server for handling wireless guest connections.

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

Mark Elsen — Wed, 26 Feb 2020 08:48:40 GMT

- Negative

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

damode — Wed, 26 Feb 2020 10:15:25 GMT

can you please explain why ?
Also, please recommend an alternative way we can achieve this ?

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

Arne Bier — Wed, 26 Feb 2020 10:26:13 GMT

Hi @damode

it’s a great question and it’s probably not the use case that Cisco intended. But there is no reason why it should not work.

i have always wanted to test this in my lab but never got around to it. I don’t know if the ISE PSN would Hand out the DNS server to the client. That would be a show stopper if it didn’t. Do you have the opportunity to try this in a lab environment?The function of a single DHCP service should not pose a problem to even a simple Linux daemon. You’re probably not concerned with lease database survivability or complex options?

I would however think this is not in your best interest because there is no way to monitor the scope usage etc or to manage the leases. I’d say look elsewhere.

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

howon — Wed, 26 Feb 2020 17:01:19 GMT

ISE will always return itself as DNS and it is not a configurable parameter.

This is not intended as production DHCP, rather it was just meant to provide DHCP during AUTH state to address the lack of URL-Redirect feature on certain NADs. I understand the OP's desire to utilize ISE for DHCP server for other purpose, but recommend using the router/switch or a purpose built DHCP server.