Foreign-Anchor WLC

[fatalXerror]

Hi guys, would it be possible if my foreign wlc is in the DC then my anchor wlc will be at each sites for the foreign-anchor design? thanks

[balaji.bandi]

high level possible as long as this was reachable may be to get more clarity you have high level diagram ?

[fatalXerror]

Hi @balaji.bandi , thanks for the feedback. basically, i want my guest users just to be at the anchor WLC.

by the way, regarding integration to ISE, the anchor WLC will be the one communicating to the ISE for guest auth right? thanks

[balaji.bandi]

that is possible - yes If you have ISE you can use Guest Authentication. (its easy )

[Rich R]

There's a discussion of that subject at https://community.cisco.com/t5/network-access-control/ise-2-2-foreign-and-anchor-wlc-radius-auth-and-accounting/td-p/3814015

[Rich R]

Well actually it's normally intended to be the opposite way around - the anchor is normally at the DC and the foreign is at each site!
https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-campus-lan-wlan-design-guide.html#Guestwireless Figure 38
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/WirelessNetwork_GuestAccessService.html Figure 10-1
But it all depends where your users and your internet DMZ are.