Question

A network engineer is designing guest access for a campus with Cisco Catalyst switches and ISE. The security team requires that all guest credentials be validated centrally on ISE, that ISE dynamically push the redirect URL and a downloadable ACL to the switch after MAB, and that no web portal be hosted on the switch itself. Which web authentication method should the engineer configure to meet these requirements?

Accepted Answer

Central Web Authentication (CWA) triggered after MAB, with the redirect URL and redirect ACL returned by ISE in the authorization result

Answer

Local Web Authentication (LWA) using the switch's built-in web portal with credentials proxied to a RADIUS server

Answer

Local Web Authentication with an externally hosted custom login page redirected by the switch

Answer

Device Sensor-based authentication using CDP/LLDP attributes to place guests in a portal VLAN