Cisco ISE Guest configuration for DNS

[Aqi Shah]

Dear All,

we are facing issue related to guest access right now customer have there seprate network seprate vlan which is connected fw and DHCP scope is defined on firewall when user comes in it connect to internet get ip form internet and without connected.

we configure self registerd guest access and reciving attached error DNS is not resolving portal because we have made entries on Local DNS

Is there any posibility so we can made it simple thanks for your suggestions.

[JohnNewman7082 · Accepted solution]

Hi Aqeel,

  From your explanation, I assume that the guest clients simply are not getting a DNS response for your ISE servers due to the network design.  There are a few options here, but each have their own caveat.

1. Use a static URL for ISE

   Policy > Policy Elements > Results,  click your redirect.  Check the check box for static URL.

Here, you can setup either DNS that is resolvable or an IP address.   The issue with using a static DNS entry, it breaks redundancy. 

There are ways to get around this, which we can go into if needed, but too much for right now.

If you use the IP address, the same issue with redundancy comes in, but you also are going to start facing certificate issues because you can not get a 3rd party cert for a private IP.

2. open a hole for your guests to hit your internal DNS server.  This way they can get a proper response.

3. Create a DNS server just for the guest environment.

[hslai]

It's best to troubleshoot and find out why DNS not resolving correctly.

I agreed with JohnNewman7082's points 2 and 3. I think point 1 should only be used during troubleshooting.