300-425 Question 208
Select 4An organization is deploying a Cisco wireless network and wants to provide lightweight web authentication (LWA) for guest users. They have Cisco Identity Services Engine (ISE) integrated into their infrastructure. Which of the following steps are required to successfully configure LWA using ISE?
- A
Configure a redirect ACL on the Wireless LAN Controller (WLC) to redirect guest traffic to the ISE portal.
- B
Enable WebAuth on the guest SSID and specify the ISE portal URL as the redirect destination.
- C
Configure a pre-shared key (PSK) on the guest SSID for authentication.
- D
Ensure that the ISE Guest Portal is enabled and correctly configured to accept guest logins.
- E
Integrate the WLC with ISE using RADIUS for authentication and accounting.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To configure Lightweight Web Authentication (LWA) using Cisco ISE, several components must work together. The WLC must have a redirect ACL to direct guest traffic to the ISE portal, and WebAuth must be enabled on the SSID with the correct redirect URL. The ISE Guest Portal must be properly configured to handle guest logins, and the WLC must be integrated with ISE using RADIUS to manage authentication and accounting. However, PSK is not required for LWA, as the authentication happens via the web portal.
- A. Correct.
This is correct. A redirect ACL on the WLC is necessary to ensure that guest traffic is redirected to the ISE Guest Portal for authentication.
- B. Correct.
This is correct. WebAuth must be enabled on the guest SSID, and the ISE portal URL must be specified as the redirect destination to facilitate LWA.
- C. Incorrect.
This is incorrect. Lightweight Web Authentication (LWA) does not require a pre-shared key (PSK). Instead, users authenticate through a web portal.
- D. Correct.
This is correct. The ISE Guest Portal must be properly configured to accept guest user credentials and handle the authentication process.
- E. Correct.
This is correct. The WLC must be integrated with ISE using RADIUS to handle authentication and accounting for guest users.