ISE Guest Access with Flex connect APs

[Corey Schultz]

I am working on a design where the end user has there APs in Flex Connect mode. Corporate users access one SSID that drops them on the corp vlan and Guest users access another SSID which drops them on the guest vlan. There are many remote sites each with there own internet connection and in many cases there is no local WLC. The WLC talks to the APs over the corporate Network. There is no connectivity between the guest network and the Corporate network - Completely segmented. Is it possible to use ISE Guest functionality in this scenario - The hope is that the ISE PSN could sit centralized on a corporate DMZ and be internet accessible to the guest portal. The Guest Users would have an inital ACL that provided access to  the basic protocols and include the internet accessible PSN. Once authenticated on the PSN the ACL would then be changed to allow full internet access. I am wondering if there are issues or potential problems with this config. Also open to other/better ways of handling this issue.

Thanks!

[hslai · Accepted solution]

Please refer to the following docs:

• How To: Universal Wireless Controller (WLC) Configuration for ISE Appendix B discusses FlexConnect AP and WLAN
• Central Web Authentication with FlexConnect APs on a WLC with ISE Configuration Example
• ISE with Static Redirect for Isolated Guest Networks Configuration Example

And, many more @ ISE Guest & Web Authentication