300-430 Question 204
Select 3An organization wants to provide secure guest Wi-Fi access using a Captive Web Portal (CWP) through Cisco ISE. Guests should be able to self-register and receive their login credentials. During the configuration, which of the following steps must be implemented to achieve a successful Central Web Authentication (CWA) process?
- A
Configure a redirect ACL on the Wireless LAN Controller (WLC) to forward unauthenticated users to the Cisco ISE portal
- B
Enable RADIUS Change of Authorization (CoA) on Cisco ISE
- C
Create a DHCP scope on the WLC for guest users to provide IP addresses
- D
Configure a policy set in Cisco ISE to match the guest WLAN and apply the CWA profile
- E
Enable WPA3-Enterprise security on the guest WLAN
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement CWA using Cisco ISE, it is essential to configure a redirect ACL on the WLC to forward unauthenticated traffic to ISE, enable RADIUS CoA for dynamic reauthorization after successful registration, and create a policy set in ISE to match guest WLAN traffic and apply the CWA rules. These steps ensure the guest devices are redirected to the self-registration portal, authenticated, and authorized appropriately. Configuring DHCP on the WLC or using WPA3-Enterprise security is not relevant to the CWA process.
- A. Correct.
Correct: A redirect ACL is required on the WLC to forward unauthenticated traffic to the Cisco ISE portal for guest self-registration.
- B. Correct.
Correct: RADIUS Change of Authorization (CoA) is necessary for ISE to dynamically reauthorize the guest device once it has registered and authenticated.
- C. Incorrect.
Incorrect: While DHCP is critical for guest devices to obtain IP addresses, DHCP configuration is typically done on a dedicated DHCP server, not directly on the WLC in most enterprise environments.
- D. Correct.
Correct: A policy set in Cisco ISE is needed to identify guest WLAN traffic and apply the appropriate CWA redirection and authentication rules.
- E. Incorrect.
Incorrect: WPA3-Enterprise is not applicable for guest networks that use CWA, as the guest network typically uses open authentication with a web-based portal.