A network engineer is enabling single-SSID equivalent BYOD onboarding on a Cisco Catalyst switch for wired employees who must be redirected to the ISE BYOD portal to run the Native Supplicant Provisioning wizard. After the initial 802.1X/EAP authentication succeeds, ISE returns an authorization result containing a redirect URL and the name of a redirect ACL, but clients open a browser and never see the ISE portal. Which switch-side configuration element is most likely missing and required for the redirection to function?