Cisco ISE CWA with Meraki MR/MX - URL Redirect

[jozef]

Hello community,

I would like to implement Central Web Authentication with Meraki APs and MX using Cisco ISE. Let's image I configure open SSID with MAC based access control and a Splash page Cisco ISE Authentication.

Then I install one PSN Node in the DMZ with 2 interfaces, one from Radius traffic and one for Guest Portal. Meraki APs communicate with the PSN in the DMZ via Radius Interface. Guests are tunneled to the MX appliance in the DMZ where they are terminated in the dedicated VLAN and get an IP address. Afterwards they get access to the Internet using the WAN Interface.

Now it is necessary to make sure that guests can reach guest portal running on a separate interface on the PSN in the DMZ.

My questions:

Does MX supports DNS Rewrite (Doctoring)? When guests send DNS lookup to the Public DNS and DNS replies with the public IP of Guest Portal, can MX rewrite DNS entry and send the private IP of Guest Portal to guests?

Would it be possible to use LAN interface and route https traffic (https://guestportal.company.com:8443/...) from guests to the Guest Portal using a static route (orange line)?

If MX does not support DNS Rewrite and/or LAN interface in combination with a static route is not possible to use in this case, could guests use WAN interface, send https traffic (https://guestportal.company.com:8443/...) to the Internet and then back to the DMZ using different Internet Connection (purple line)?

Thank you for any hints.

Regards,

Jozef

[PhilipDAth]

You are trying to apply a WLC design philosophy to Meraki - and it is going to cause you grief.

The MX does not support DNS re-write.

On the whole you can not do policy routing.  However, as long as the traffic is going out a WAN interface, you can specify a flow preference like this:

On the whole, I see no point in using Cisco ISE for guest portal processing.  The built in capabilities of Meraki kit is very powerful, and Cisco ISE does nothing but add additional complexity.

If you want to do things the easy way, configure the guest portal completely inside of Meraki; drop the guests into a VLAN (don't use the VPN option) and then transport that VPN to the Internet.

[jozef · Accepted solution]

Thank you for your reply.

I have just found an easier option how to do it - LWA using ISE as the RADIUS server.  The captive portal web page would still be served from the Cloud Management Platform as today and would be able to communicate with ISE in the DMZ across the Internet for credential validation. Guest credentials would be created via the Sponsor Portal on ISE, stored on ISE and sent to the guest user per email.

[PhilipDAth]

Well done @jozef for figuring out that solution!

[PhilipDAth]

You know Meraki self a sponsor self registration system built in?

https://documentation.meraki.com/MR/Encryption_and_Authentication/Sponsored_Guest

It is like ISE - but simple to setup.  You could have the entire thing and configured and running before you have finished download the currently ISE 13GB download.

[PhilipDAth]

If you are super keen to keep use Cisco ISE have a look at this guide:

https://documentation.meraki.com/MR/Encryption_and_Authentication/Central_Web_Authentication_(CWA)_w...