Best solution - ISE vs Meraki

[kakins@alix]

Hello community,

My security team currently uses ISE for both sponsored guest wireless authentication and corporate wireless authentication (also used for "device administration" for TACACS+ and RADIUS). We recently upgraded to ISE 2.3. At the same time, the network team has been replacing our Cisco APs with Meraki APs (cloud-managed). We've had a few integration issues between Meraki and ISE that we are working through, specifically on the guest side and we are trying to make the user experience as smooth as possible. The network team has suggested switching guest wireless access and authentication totally over to Meraki.

We are planning to really ramp up using ISEs security features in the coming months (device posture, NAC, BYOD.). I want to make sure we don't cut guest over to Meraki and not be able to take advantage of ISE's security features when it can see all devices and authentication attempts. Any suggestions on whether we should keep the guest wireless authentication process on ISE or move guest over to Meraki where the Meraki's would manage the complete process for guest authentication?

Thanks!

[thomas]

Please see the ISE Design & Integration Guides > How To: Integrate Meraki Networks with ISE for specific configurations and steps to integrate ISE with Meraki if you haven't seen it already.

You have not specified your customer's Guest requirements other than "trying to make the user experience as smooth as possible" which isn't an actual Guest scenario. ISE can do Hotspot, Self-registered and Sponsored Guest scenarios. If you need to better understand these and the many options, I suggest you watch the https://cs.co/selling-ise-training > ISE 4D: Discover, Design, Demo Defend VoDs > ISE - Feature : Guest Access - Video to better understand the ISE Guest capabilities and compare them with Meraki's Guest capabilities.

You may experience the ISE Guest scenarios yourself using our ISE Demo/POV infrastructure in dCloud with your Cisco AP @ Cisco ISE 2.3 Secure Access Wizard v1.

[kakins@alix]

Hello Thomas, thanks for your response. We actually already in place with Meraki. I have it configured for Sponsored Guest and thinking of making it simpler based on our requirements by switching to using a key that we just rotate at some interval (day, week, etc.). My question is whether in the long run ISE gives me many more capabilities (considering we are going to start using many more of the security features of ISE soon). Just looking for opinions on which solution is most robust.

[thomas]

Again, I don't know your requirements other than Simpler.

Hotspot is the simplest. It sounds like you want to do require an access code in your Hotspot portal which ISE supports:

I believe ISE is more robust.

BTW, not sure why you've posted this under the Data Center area for Announcements and Events. I suggest posting under Enterprise or Security next time which is where ISE lives and we monitor more closely.