300-425 Question 200
Select 4An enterprise is deploying a Cisco Wireless solution with Central Web Authentication (CWA) using Cisco ISE. The IT administrator has configured a self-registration portal in ISE to allow guest users to create their accounts. However, guests are unable to access the network after registration. Which of the following must be verified to ensure successful CWA functionality?
- A
The redirect ACL is correctly configured on the WLC to allow DNS and HTTP/HTTPS traffic.
- B
The Guest SSID is configured for WPA2-Enterprise with 802.1X authentication.
- C
The policy set in ISE includes a condition to redirect unauthenticated users to the self-registration portal.
- D
The self-registration portal is properly enabled and accessible via the ISE interface.
- E
The WLC is integrated with ISE using RADIUS for authentication and accounting.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
For CWA to function properly, the redirect ACL must allow necessary traffic, and the WLC must be integrated with ISE for RADIUS authentication and accounting. Additionally, the ISE policy must include a redirect condition for unauthenticated users, and the self-registration portal must be enabled and accessible. WPA2-Enterprise with 802.1X authentication is not part of the CWA process, as it uses open authentication with web redirection instead.
- A. Correct.
Correct. The redirect ACL on the WLC ensures that unauthenticated users are redirected to the ISE portal while allowing necessary traffic like DNS and HTTP/HTTPS. If this is not configured, users will not be redirected to the portal.
- B. Incorrect.
Incorrect. CWA does not use WPA2-Enterprise with 802.1X authentication. Instead, it uses open authentication with a web redirection for guest users.
- C. Correct.
Correct. A policy set in ISE must include a condition to redirect unauthenticated users to the self-registration portal, enabling the CWA flow.
- D. Correct.
Correct. If the self-registration portal is not enabled or inaccessible, guests cannot complete the registration process.
- E. Correct.
Correct. The WLC must be integrated with ISE using RADIUS to handle authentication and accounting for guest users.