Question

A network engineer deploys Central Web Authentication (CWA) for guests on a Cisco Catalyst switch integrated with ISE. After a guest successfully authenticates on the guest portal, ISE must instruct the switch to remove the pre-auth redirect and apply the final guest DACL without disconnecting the endpoint's link. Which mechanism must be configured on the switch and used by ISE to accomplish this transition?

Accepted Answer

RADIUS Change of Authorization (CoA) with re-authenticate, requiring 'aaa server radius dynamic-author' on the switch

Answer

A SNMP trap sent from ISE to the switch triggering an interface bounce

Answer

RADIUS accounting interim updates that push the new DACL every 60 seconds

Answer

A session timeout on the pre-auth authorization profile that forces the endpoint to re-authenticate via 802.1X