cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
795
Views
0
Helpful
5
Replies
Participant

ISE separate interface for guest

Hi All,

 

I'm currently designing a ISE solution to provide gust access with web authentication and I want to assign separate interfaces on the ISE appliances so we dont need to punch holes through our main firewall. I have seen that this is possible in various support community conversations/design guides, however, I'm looking to place the ISE guest interfaces directly on the same VLAN that guest users will be placed on but I cant see if this is recommended or not.

 

The reason I want to do this is for simplicity so no need to even create a separate DMZ etc. Has anyone does this before? Does the ISE interface for guest listen on any other ports than what has been set for the CWA portal?

 

Many thanks

Everyone's tags (3)
5 REPLIES 5
VIP Advisor

Re: ISE separate interface for guest

Hi

 

Yes sure this is something that’s often done.

 Your switch or WLC will talk to radius using the default interface (or radius specific interface if you have any). The radius will reply with guest interface as URL redirect if you configured so on the portal itself. This is where you define which interface listen for portal ports.

As soon as URL redirect is pushed, guest users will be pushed a guest vlan within dmz zone where they can reach  ISE 2nd interface and avoid opening ports on your FW.

 

You can extended your DMZ vlan to this 2nd ISE interface to make sure guests won’t sit in your lan.

 

Usually, what I do is keeping default interface for management, then add a dedicated interface for radius/tacacs and 3rd one for guests.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Participant

Re: ISE separate interface for guest

Hi Francesco,

 

Thank you for the response. That make sense.

 

In this particular environment we are looking to included a wired guest network as well which will be in a separate VLAN. In this instance should we use 3 interfaces on ISE? Default interface for management/Radius etc, one interface for Wireless Guest and one interface for Wired Guest?

 

In your environments, would you normally have wireless and wired guest in the same VLAN or split them out? I'm just conscious that I'm making this more complex then it needs to be.

 

Thank you

VIP Advisor

Re: ISE separate interface for guest

For my point of view wired guest and wireless guest should be in separated vlans but in the same zone. This means that only 1 interface on ISE can handle both.

 


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Highlighted
Participant

Re: ISE separate interface for guest

Thanks Francesco,

 

When you say 'Zone' do you mean a common DMZ interface that is accessible from both the Wired and Wireless guest networks?

 

VIP Advisor

Re: ISE separate interface for guest

Yes I meant DMZ interface. When clients (either wifi and wired) are redirected to guest portal, they'll be pushed to a specific vlans that needs to be able to reach ISE guest/dmz interface.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question