Wired Guest Using ISE Interface

[bret]

Ive scoured the forums for a solution but struck out looking for design tips. I have a centralized guest wireless using ISE with CWA on an anchor controller and it works great. Now I need to create wired guest network for my remote sites. Is this possible using an interface on my 3415 running ISE, or can the anchor controller be used some how?

The 3415 sits in my Pennsylvania data center. It has a new dedicated interface going to the internet for guest traffic. Can this interface be used as a redirect for a guest at a remote site? If so, is there documentation detailing the basic steps to implement this?

Thanks in advance!

[Justin bollinger]

If you are already authenticating your wireless users and anchoring them to a DMZ you can do the same with wired users as long as you have a foreign controller layer 2 adjacent to the wired guests.  

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/99470-config-wiredguest-00.html

You would just need to set the VLAN on the port for the guest users, or if you want you can use ISE wired AuthZ policy to place the guest users into the correct VLAN, or FlexAuth using guest VLANs.  

[bret]

Thanks Justin, but thats the problem. Both the foreign and anchor controller sit in the data center. There are no remote controllers.

[Justin bollinger]

Is there a requirement that the Guest traffic is tunneled to the DMZ where the anchor controller is?

You can still utilize ISE to assign the guest vlan ID and use PBR/GRE tunnels to get the traffic to the DMZ, but again I am making some assumptions on the type of equipment that you have at the remote sites.  

What equipment do you have at the remote sites?  Include the licensing level for routers/L3 switches