300-425 Question 202
Select 4You are configuring a Guest Wi-Fi network for a client using Cisco ISE. The client wants users to self-register through a captive portal and be granted network access after accepting terms and conditions. Which of the following steps must you configure in Cisco ISE to implement Centralized Web Authentication (CWA) with a self-registration portal?
- A
Configure a Guest Portal with self-registration enabled in Cisco ISE
- B
Set up a Policy Set in Cisco ISE with Authentication and Authorization rules
- C
Enable RADIUS Change of Authorization (CoA) on the network access device
- D
Configure an ACL on the network access device to redirect HTTP/HTTPS traffic to Cisco ISE
- E
Enable 802.1X authentication for guest users
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Centralized Web Authentication (CWA) with a self-registration portal requires multiple configurations in Cisco ISE and the network infrastructure. A Guest Portal with self-registration provides the interface for users to register and accept terms. Policy Sets define the rules for handling guest traffic. RADIUS CoA is essential for updating the user's session after portal authentication, and ACLs on the network device redirect guest traffic to Cisco ISE for authentication. 802.1X is not typically used in guest access scenarios since it is designed for secure employee access.
- A. Correct.
Correct: A Guest Portal with self-registration is required to allow users to create their own accounts and accept terms and conditions.
- B. Correct.
Correct: Policy Sets in Cisco ISE define the Authentication and Authorization rules needed for CWA and guest access workflows.
- C. Correct.
Correct: RADIUS CoA is mandatory for updating the user's session after successful authentication through the portal.
- D. Correct.
Correct: ACLs on the network access device are necessary to redirect guest users' HTTP/HTTPS traffic to the Cisco ISE captive portal for authentication.
- E. Incorrect.
Incorrect: 802.1X is not typically used for guest users in CWA scenarios. Instead, MAC Authentication Bypass (MAB) or open authentication is used to provide network access for redirection.