Hello community,   I would like to implement Central Web Authentication with Meraki APs and MX using Cisco ISE. Let's image I configure open SSID with MAC based access control and a Splash page Cisco ISE Authentication.       Then I install one PSN Node in the DMZ with 2 interfaces, one from Radius traffic and one for Guest Portal. Meraki APs communicate with the PSN in the DMZ via Radius Interface. Guests are tunneled to the MX appliance in the DMZ where they are terminated in the dedicated VLAN and get an IP address. Afterwards they get access to the Internet using the WAN Interface.           Now it is necessary to make sure that guests can reach guest portal running on a separate interface on the PSN in the DMZ.   My questions:   Does MX supports DNS Rewrite (Doctoring)? When guests send DNS lookup to the Public DNS and DNS replies with the public IP of Guest Portal, can MX rewrite DNS entry and send the private IP of Guest Portal to guests?   Would it be possible to use LAN interface and route https traffic (https://guestportal.company.com:8443/...) from guests to the Guest Portal using a static route (orange line)?   If MX does not support DNS Rewrite and/or LAN interface in combination with a static route is not possible to use in this case, could guests use WAN interface, send https traffic (https://guestportal.company.com:8443/...) to the Internet and then back to the DMZ using different Internet Connection (purple line)?     Thank you for any hints.   Regards, Jozef   ... View more