Best place to create the DHCP scope for Guest SSID for remote office connected to HQ Foreign-Anchor controller

[vinodjad1234]

Hi Experts ,

Need help with the respect to understand the best practice to place/create the DHCP scope for remote site Guest SSID which will be connected to HQ Foeign-Anchor controller set-up.

how about internet traffic for Guest SSID , which one will be recommanded :

1) Guest SSID gets authenticated from HQ ISE and exposed to the local internet

2) Guest SSID gets authenticated from HQ ISE and exposed to the HQ internet

Thanks

[George Stefanick]

Most people that have remote offices will typically anchor guest back to HQ to manage and shap the traffic. Think of having one funnel to do what you please with guest. This is of course if the pipe can handle the guest back. In this case you need a DHCP server in the DMZ. 

[vinodjad1234]

Hi George ,

Thanks for your reply ...So you mean, best design would be to create the DHCP scope into DMZ for guest and let it get exposed to HQ internet ...

how about if I have another anchor controller in lets say in other  office and I need to anchor the traffic or load balance from HQ foreign controller , in that case if I create DHCP scope into HQ anchor controller and if its down , I will loose the connectivity , how do I achieve fail-over to another anchor ?

Do I need to create secondary scope into another anchor controller and let the client get reauthenticated from other location ISE and get ip address as well from another anchor controller . Is it what you are proposing ?

[George Stefanick]

What you typically see is two anchors in the DMZ sharing the guest offload. The foreign controller will round robin the guest onto the controller. Both controllers and share the same guest subnet. 

[George Stefanick]

On the way into the office i was thinking about your question. If you allow capwap through the FW and the aps can find the WLC and you connect layer 2 to the controller between both networks and you don't LAG you could likely leg into both networks. 

but if you have problems and call tac they will give you a hard time .. 

get a controller and test it out ..

[George D]

sorry to bump an old thread, but we were considering something similar. does the client get a new ip address from the failover controller if it was in another dmz and different scope?