Question

A network engineer is deploying Central Web Authentication (CWA) for guest wireless users on a remote-site Cisco WLC where the APs operate in FlexConnect mode with local switching. Wired traffic from these APs does not traverse the WLC. Guests connect to an open SSID, associate via MAB, and are supposed to be redirected to the ISE guest portal. However, users associate but never receive the redirect. What must the engineer configure on the WLC to make the CWA redirection work in this FlexConnect local-switching scenario?

Accepted Answer

Define the redirect ACL as a FlexConnect ACL and apply it to the AP group or flex profile so it is pushed to the local switching APs

Answer

Configure the redirect ACL only as a standard named ACL on the WLC controller and reference it in the ISE authorization profile

Answer

Disable AAA override on the WLAN so the WLC applies the redirect locally instead of relying on ISE

Answer

Change the APs from FlexConnect to local mode so the WLC can enforce the redirect ACL centrally