300-425 Question 205
Select 3An organization is deploying guest Wi-Fi access and plans to use Local Web Authentication (LWA). They want to integrate the solution with Cisco Identity Services Engine (ISE) for authentication and policy enforcement. Which of the following configurations are required to successfully implement LWA using ISE or WLC?
- A
Configure the WLAN on the WLC to use the 'Layer 3 Web Policy' with the 'Authentication' option enabled.
- B
Ensure that the WLC is added as a Network Device in Cisco ISE with a shared secret.
- C
Enable 802.1X authentication on the WLAN for all guest users.
- D
Configure a redirect URL on the WLC to point to the ISE's Guest Portal.
- E
Use the default WLC self-signed certificate for HTTPS redirection.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement Local Web Authentication (LWA) using Cisco ISE or WLC, the WLAN must be configured with a Layer 3 Web Policy with authentication enabled, the WLC must be added to ISE as a Network Device with a shared secret, and a redirect URL must be configured to direct users to the ISE's Guest Portal. Using 802.1X for guest access is not required, and a valid certificate should replace the default WLC self-signed certificate to avoid browser trust issues.
- A. Correct.
Correct: Local Web Authentication requires the WLAN to be configured with a Layer 3 Web Policy and the 'Authentication' option enabled to trigger the redirection to the ISE portal.
- B. Correct.
Correct: The WLC must be added to Cisco ISE as a Network Device with the proper shared secret to enable communication and RADIUS authentication.
- C. Incorrect.
Incorrect: 802.1X is not used for guest access in an LWA setup. Instead, guests are authenticated through the web portal after being redirected.
- D. Correct.
Correct: A redirect URL is required to point the client devices to the ISE's Guest Portal for web-based authentication.
- E. Incorrect.
Incorrect: The default self-signed certificate on the WLC is not recommended because it may cause browser warnings. A valid, trusted certificate should be used to avoid trust issues.