So I am stuck between a rock and a hard place with this client. They were sold them ISE to use for their guest wireless. They were also sold anchor WLC's to use to for their guest wireless to make it more secure. The problem I am having is at one site, they need to use DNS rewrite for one NAT statement, which requires DNS inspection to be enabled. The NAT statement is to allow their current and new (when it goes in to prod) guest wireless to reach their Citrix server. Well, since they are using ISE, the guest wireless clients need to be able to resolve the hostname of the ISE server in the web redirect. I know you can set ISE to use the IP address, but that will give them cert errors and that's a no-no.
When I test DNS resolution using the internal DNS servers from the guest wireless, it fails with DNS inspection enabled. When DNS inspection is off, it works fine. Is there any sort of workaround for this or is it just not going to work?
TIA,
Dan
