ISE Guest Portal Via Internet

[PaulPatterson99634]

I am looking to deploy a ISE Guest Portal for my guest network users. In the deployment design, I am also looking to separate the guest traffic through a guest vrf. In doing so, if a guest attempts to join the network through a SSID that is vrf off, they would not be able to reach the internal ISE server to reach the guest portal.

So my question is, is there a way that I can proxy the ISE guest portal to the internet so that the guest user will go out through the local internet and still will be able to reach the ISE guest portal via internet? 

[balaji.bandi]

So my question is, is there a way that I can proxy the ISE guest portal to the internet so that the guest user will go out through the local internet and still will be able to reach the ISE guest portal via internet? 

Until user get authentiated, he can not get authorisation to use Interenet right ? If you looking to leak (this will be not secured and missing authorisation)

You need to find alternative high availability to reach ISE portal (that is best i can suggest). - rather over engineering the traffic flow for authe ntication.

 if a guest attempts to join the network through a SSID that is vrf off, they would not be able to reach the internal ISE server to reach the guest portal.

if that VRF down, how will use able to go other path ?

[thomas · Accepted solution]

Consider using a guest anchor controller design to get your Guest traffic out of your local network and into a DMZ:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/WirelessNetwork_GuestAccessService.html

You will want to have an ISE PSN accessible within or from the DMZ to serve the centralized web authentication pages.