A network engineer is deploying Central Web Authentication (CWA) on a Catalyst switch running IOS. Endpoints authenticate via MAB, and ISE returns an authorization result containing a redirect URL and a redirect ACL. However, after connecting, test endpoints receive an IP address but the browser never displays the ISE guest portal — the redirection simply times out. RADIUS accounting and the CoA are confirmed working. Which switch configuration step is most likely missing and required for the redirect to function?