cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

417
Views
0
Helpful
6
Replies
Highlighted
Beginner

Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

I have a client who wants to deploy only single ISE node in their environment for wireless guest access.

 

  • Their current DHCP server is configured in AD which is hosted in their datacentre.
  • They are using Meraki MX devices for wireless
  • ISE will be part of Corp network.
  • Their concern is they dont want guest devices accessing the AD server for DHCP/DNS.

 

In this case, I was wondering if I could use ISE as DHCP and DNS server. But I read in docs that these features exist in ISE for third party NAD devices that dont support dynamic or static url redirection.

 

So, my question is, even though the client's NAD device would be Meraki, in that case, can I use ISE as DHCP and DNS server ?

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

ISE will always return itself as DNS and it is not a configurable parameter.

This is not intended as production DHCP, rather it was just meant to provide DHCP during AUTH state to address the lack of URL-Redirect feature on certain NADs. I understand the OP's desire to utilize ISE for DHCP server for other purpose, but recommend using the router/switch or a purpose built DHCP server.

View solution in original post

6 REPLIES 6
Highlighted
VIP Engager

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

 

 - Basically not as the below thread will confirm : MS-AD is indeed not a good solution for DHCP, better is to look into appliances such as infoblox or others. These can offer extended and flexible configuration for lots of vlan's and subnets.

     https://community.cisco.com/t5/network-access-control/ise-with-dhcp-server/td-p/3540467

 M.

Highlighted
Beginner

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

They are already using MS-AD now for DHCP.

The question is whether we can use ISE as DHCP and DNS server for handling wireless guest connections.
Highlighted
VIP Engager

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

 

 - Negative 

    M.

Highlighted
Beginner

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

can you please explain why ?
Also, please recommend an alternative way we can achieve this ?
Highlighted
VIP Advocate

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

Hi @damode 

 

it’s a great question and it’s probably not the use case that Cisco intended. But there is no reason why it should not work. 

i have always wanted to test this in my lab but never got around to it. I don’t know if the ISE PSN would Hand out the DNS server to the client. That would be a show stopper if it didn’t. Do you have the opportunity to try this in a lab environment?The function of a single DHCP service should not pose a problem to even a simple Linux daemon. You’re probably not concerned with lease database survivability or complex options?

I would however think this is not in your best interest because there is no way to monitor the scope usage etc or to manage the leases. I’d say look elsewhere. 

Highlighted
Cisco Employee

Re: Can we use ISE as DHCP/DNS server to prevent guest traffic using internal DHCP/DNS servers ?

ISE will always return itself as DNS and it is not a configurable parameter.

This is not intended as production DHCP, rather it was just meant to provide DHCP during AUTH state to address the lack of URL-Redirect feature on certain NADs. I understand the OP's desire to utilize ISE for DHCP server for other purpose, but recommend using the router/switch or a purpose built DHCP server.

View solution in original post