Move ISE to another network than the WLC (guest access)

[mgollob]

In my pilot project, where I use an ISE Guest Portal for the guest WLAN, ISE and WLC are on the same network. For security reasons, the ISE should then move to its own DMZ. Do I have problems with the authentication of the guests or with the traffic of the WLC that has to go to the ISE? Does the WLC have to be in the DMZ? I hope it once not

[patoberli · Accepted solution]

That is absolutely no problem and the standard for most setups. You just need to make sure the DACL and routing is correct.