SISE Web Auth And Guest Services — 20 Questions

Question 1

A sponsor wants to approve guest accounts via email. Where in ISE must the sponsor account be created and configured to allow this capability?

Accepted Answer

Guest Access > Configure > Sponsor Portals. The Sponsor Portal is where sponsors manage guest accounts, including approval workflows and email notifications.

Answer

Administration > Identity Management > Identities

Answer

Work Centers > Guest Access > Sponsor Groups

Answer

Policy > Policy Elements > Results

Question 2

When designing a guest network, you want to ensure that guests cannot reach each other. What is the most effective way to prevent this?

Accepted Answer

Apply a dACL that denies all traffic to the guest subnet.. Private VLANs (PVLANs) or client isolation on the wireless controller are the standard methods to prevent direct client-to-client communication at the link layer.

Answer

Enable MAC filtering on the ISE.

Answer

Configure a higher VLAN for the guests.

Answer

Configure a static route on the default gateway.

Question 3

Which TWO of the following can be used to identify a guest device for MAC caching?

Accepted Answer

The Guest Portal ID.. MAC caching relies on the device's MAC address and sometimes the specific portal being accessed to differentiate sessions and cache the device status.

Answer

The user's email address.

Answer

The switch's hostname.

Answer

The user's IP address.

Question 4

Which THREE of the following are mandatory fields for configuring a new Guest Portal in ISE?

Accepted Answer

Portal Name.. Creating a portal requires a unique name, a defined portal type (Hotspot, Guest, etc.), and the selection of the Policy Service Node (PSN) that will host the portal.

Answer

Default Sponsor email.

Answer

Primary DNS server IP.

Question 5

Which THREE of the following items are included in a typical RADIUS Authorization Profile for a CWA redirect?

Accepted Answer

cisco-av-pair = url-redirect-acl.. A redirect-capable profile must include the redirection URL, the redirect ACL name, and the specific class or group attributes to identify the user's role.

Answer

The RADIUS shared secret.

Answer

The 'Framed-IP-Address'.

Question 6

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. LWA requires the NAD to act as the web server for the captive portal, meaning the switch handles the HTTP request interception directly, unlike CWA where the endpoint is redirected to ISE.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 7

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The switch (NAD) performs the redirection based on the 'url-redirect' attribute provided by ISE in the RADIUS access-accept.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 8

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Accepted Answer

The ISE server certificate is self-signed or not trusted by the client device.. Guest portals use HTTPS. If the ISE certificate is not signed by a trusted CA, the browser will display a warning.

Answer

The ISE portal is configured for HTTP instead of HTTPS.

Answer

The DNS server is not resolving the ISE FQDN.

Answer

The switch is not configured for SSL interception.

Question 9

You are implementing a Guest flow that requires the user to accept an Acceptable Use Policy (AUP). Where is the AUP text configured within the Cisco ISE portal settings?

Accepted Answer

Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization. The AUP is defined within the Guest Portal's 'Page Customization' settings under the 'Acceptable Use Policy' section.

Answer

Policy > Policy Elements > Results > Authorization Profiles

Answer

Work Centers > Guest Access > Settings > AUP

Answer

Administration > System > Settings > Guest

Question 10

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. After successful portal authentication, ISE sends a RADIUS CoA to the NAD. If the NAD is not configured to accept CoA, the session remains in the initial state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.

Question 11

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

Accepted Answer

Enable MAC Caching. MAC Caching allows ISE to remember the device after the first authentication, preventing repeated portal logins. This is enabled under the Guest Portal settings for MAC Caching.

Answer

Enable Auto-Login

Answer

Enable Guest Flow Bypass

Answer

Enable Device Registration

Question 12

A network administrator is configuring Central Web Authentication (CWA) and needs to ensure that the initial redirect is handled correctly by the switch. Which attribute must the Cisco ISE send to the network access device (NAD) to trigger the redirection?

Accepted Answer

cisco-av-pair = url-redirect=https://ise.example.com:8443/guestportal/gateway. The Cisco-AV-Pair 'url-redirect' is the standard attribute used in a RADIUS Accept message to inform the switch to redirect web traffic to the ISE guest portal.

Answer

cisco-av-pair = redirect-url=http://ise.example.com

Answer

cisco-av-pair = redirect-to=https://ise.example.com

Answer

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Question 13

Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?

Accepted Answer

Daily Guest Account. An 'Expiring' account is designed to be time-bound, and ISE automatically removes it upon expiration based on the defined policies.

Answer

Self-Registered Guest

Answer

Hotspot Guest

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 16

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

Accepted Answer

It specifies the name of the ACL on the NAD that defines traffic to be intercepted.. This attribute tells the NAD which ACL to use to determine which packets should be redirected and which should be allowed to proceed without redirection (e.g., DNS, DHCP, and traffic to ISE).

Answer

It defines the URL to which the user is redirected.

Answer

It triggers the CoA process.

Answer

It defines the guest group permissions.

Question 17

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

Accepted Answer

Work Centers > Guest Access > Configure > Guest Portals. The 'Portal Page Customization' section within the specific portal configuration allows for uploading custom logos and changing themes.

Answer

Administration > System > Settings

Answer

Policy > Policy Elements > Results

Answer

Administration > Identity Management > Identities

Question 18

A Guest user is stuck in a loop and cannot access the internet after authenticating. The NAD log shows the session is bouncing between the redirect state and authorized state. What is the most likely cause?

Accepted Answer

The Redirect ACL does not permit traffic to the ISE PSN IP.. If the Redirect ACL is not properly configured to exclude the ISE PSN IP, the traffic to the ISE portal might get redirected again, causing a loop.

Answer

The guest user account is expired.

Answer

The switch is configured for redundant ISE nodes.

Answer

The CoA port is blocked by a firewall.

Question 19

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

Accepted Answer

The NAD is not processing the CoA request sent by ISE.. If the session is not updated, the switch doesn't know the status has changed. A CoA is required to re-evaluate the session after approval.

Answer

The guest password has expired.

Answer

The guest account is not in the correct group.

Answer

The browser cache is preventing the redirect.

Question 20

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

Accepted Answer

Self-Registration Account Activation. Email verification requires the user to click a link sent to their email to activate the account. This is configured in the self-registration portal settings.

Answer

Enable Guest MAC Caching

Answer

Enable Captcha

Answer

Require Sponsor Approval