300-430 Question 207
Select 4You are deploying a guest Wi-Fi solution using Local Web Authentication (LWA) on a Cisco network. The network includes a Cisco Wireless LAN Controller (WLC) and Cisco Identity Services Engine (ISE). During configuration, you need to ensure that the authentication process is redirected to a customizable web portal hosted on ISE. Which of the following steps are REQUIRED to successfully enable LWA in this scenario?
- A
Configure a Redirect ACL on the WLC to allow unauthenticated traffic to reach the ISE portal.
- B
Enable the Guest Anchor feature on the WLC to separate guest traffic from internal users.
- C
Create a Guest Portal and configure it in ISE with appropriate authentication policies.
- D
Enable the 'Web Authentication' feature under the WLAN settings on the WLC.
- E
Ensure that the WLC is configured as a RADIUS client on ISE.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To implement Local Web Authentication (LWA) using ISE and WLC, multiple configuration steps are necessary. The WLC must redirect unauthenticated traffic to the ISE portal using a Redirect ACL and enable the 'Web Authentication' feature on the WLAN. On the ISE side, a Guest Portal must be configured to handle authentication requests, and the WLC must be defined as a RADIUS client so it can communicate with ISE for authentication purposes. The Guest Anchor feature, while useful in certain network designs, is not a requirement for LWA.
- A. Correct.
Correct. A Redirect ACL on the WLC is necessary to allow unauthenticated devices to access the ISE portal for web authentication. Without this, the redirection will fail.
- B. Incorrect.
Incorrect. The Guest Anchor feature is not a requirement for LWA. It is typically used in scenarios with multiple WLCs to centralize guest traffic, but it is not directly related to enabling LWA.
- C. Correct.
Correct. A Guest Portal must be configured in ISE to provide the web interface and authentication mechanism for LWA. This step is critical to the solution.
- D. Correct.
Correct. The 'Web Authentication' feature must be enabled on the WLAN settings of the WLC to trigger the redirection to the ISE portal.
- E. Correct.
Correct. The WLC must be configured as a RADIUS client on ISE to facilitate communication and authentication requests between the two devices.