Question

An engineer is configuring single-SSID BYOD onboarding on a Cisco WLC (AireOS) using ISE with its internal CA. After a user authenticates via dot1x on the corporate SSID with an unregistered device, ISE returns an authorization result that references a named ACL to steer the client to the BYOD provisioning portal. During testing, the client associates but never receives the ISE redirect to the Native Supplicant Provisioning portal, even though the WLC's RADIUS NAC/CoA settings are correct. Which action on the WLC most likely resolves the missing redirect?

Accepted Answer

Create the redirect ACL locally on the WLC with the exact name referenced by the ISE authorization profile, permitting DNS and traffic to ISE while denying other traffic to trigger redirection

Answer

Enable a downloadable ACL (dACL) on the WLC so ISE can push the full redirect ACL contents at authorization time

Answer

Disable AAA override on the WLAN so the WLC applies its default policy instead of the ISE-supplied ACL name

Answer

Configure the redirect ACL as a FlexConnect ACL only, since AireOS WLCs cannot process standard named ACLs for central redirection