ISE Guest portal using public DNS

[jerry.larson]

Hello community, 

Is it possible to use public DNS for ISE guest splash page. If not possible how would I handle this? We have an api that users need to access while on site, but we do not want to open access to the private IP. We want them to go out to the internet and back in. Is it possible to do both with a public DNS server? We currently use internal DNS for guest, they are unable to access the api without opening a hole in the firewall which we do not want to do.

thank you, 

[Jason Kunst]

This has been answered many times did you search the community?

[jerry.larson]

I will do a search, did not see it.

[Damien Miller · Accepted solution]

What you want to do is definitely supported.  One way I have seen it done is to place internal IP's in the external DNS, then rely on "leak" of guest redirection traffic to an internal ISE node, or DMZ.  At the end of the day the user needs to resolve the hostname, and be able to reach the web portal.

An alternate could be what Arne posted over here recently.
https://community.cisco.com/t5/identity-services-engine-ise/ise-guest-and-dns/m-p/3839857/highlight/true#M25895