350-401 Question 273
Select 4A network engineer is implementing WebAuth on a Cisco Wireless LAN Controller (WLC) to provide guest access. The engineer configures a WLAN with a pre-authentication ACL to allow DNS and DHCP traffic but notices that guests cannot access the WebAuth portal. Which of the following steps should the engineer take to resolve the issue?
- A
Ensure that the WebAuth redirect URL is properly configured on the WLC.
- B
Verify that the pre-authentication ACL permits HTTP and HTTPS traffic to the WLC.
- C
Enable Layer 3 security on the WLAN and select Web Policy with WebAuth.
- D
Configure the WLC to use a RADIUS server for WebAuth authentication.
- E
Check if the virtual interface on the WLC has a valid IP address.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To resolve WebAuth issues, it is crucial to verify that the WebAuth redirect URL is configured and that the pre-authentication ACL permits traffic necessary for DNS, DHCP, HTTP, and HTTPS. Additionally, Layer 3 security and Web Policy with WebAuth must be enabled on the WLAN. The WLC's virtual interface must have a valid IP address, as it is used for the redirection process. While RADIUS authentication can enhance WebAuth, it is not a requirement for the issue described in this scenario.
- A. Correct.
The WebAuth redirect URL must be properly configured on the WLC for clients to be redirected to the portal. Without this configuration, the WebAuth process will fail.
- B. Correct.
The pre-authentication ACL must allow HTTP and HTTPS traffic to the WLC so that clients can access the WebAuth portal. Blocking these ports will prevent redirection.
- C. Correct.
Layer 3 security must be enabled on the WLAN, and Web Policy with WebAuth must be selected to activate WebAuth functionality.
- D. Incorrect.
Using a RADIUS server for WebAuth authentication is optional and not required for basic local WebAuth functionality. This is not necessary to fix the current issue.
- E. Correct.
The virtual interface on the WLC must have a valid IP address because it is used as the source address for WebAuth redirection. An invalid or misconfigured IP can cause the WebAuth process to fail.