CCNA Web Auth And Guest Services Questions

After successful portal authentication, ISE sends a RADIUS CoA to the NAD. If the NAD is not configured to accept CoA, the session remains in the initial state.

The AUP is defined within the Guest Portal's 'Page Customization' settings under the 'Acceptable Use Policy' section.

CWA requires a specific authorization profile that includes redirection, an authentication rule that bypasses MAB or uses it as a trigger, and the appropriate URL redirect ACLs.

Guest portals use HTTPS. If the ISE certificate is not signed by a trusted CA, the browser will display a warning.

MAC Caching allows ISE to remember the device after the first authentication, preventing repeated portal logins. This is enabled under the Guest Portal settings for MAC Caching.

The 'Self-Registration' page settings in the Guest Portal configuration allow enabling fields such as 'Email Address' and configuring the 'Email Validation' mechanism.

The workflow involves the guest requesting access, the sponsor receiving an email notification, and the sponsor logging into the portal to approve or deny the request.

The 'Post-Login' landing page configuration in the Guest Portal allows you to define the URL to which the user is redirected after a successful authentication.

The Hotspot portal is specifically designed for 'click-through' access, commonly used in public Wi-Fi environments.

If the session is not updated, the switch doesn't know the status has changed. A CoA is required to re-evaluate the session after approval.

The 'My Devices' portal is explicitly designed for guests or employees to manage their own registered devices for network access.

The Sponsor Portal provides tools for account creation, lifecycle management (extending/revoking), and viewing the status of guest accounts.

Portal customization is managed under the Guest Access menu, specifically within the Portal Builder of the selected portal type.

If the portal FQDN is not resolvable or the portal service on the PSN is not active, the user will reach a non-existent page.

Internal Server Errors often relate to issues with the ISE node itself, such as database connectivity problems or the portal service being crashed/unresponsive.

An 'Expiring' account is designed to be time-bound, and ISE automatically removes it upon expiration based on the defined policies.

Guest types define the lifecycle of a guest account, including time-to-live, max devices, and session duration.

Email verification requires the user to click a link sent to their email to activate the account. This is configured in the self-registration portal settings.

For CWA, the authorization profile must include a dACL or a filter-ID, and the Web Redirection component must be enabled with the specific Client Provisioning or Guest portal selected as the target.

The 'Portal Page Customization' section within the specific portal configuration allows for uploading custom logos and changing themes.

In LWA, the WLC acts as the RADIUS client that sends the user-provided credentials to Cisco ISE for authentication.

ISE checks the validity of the account (status), whether the account has expired, and if the specific credentials provided match the stored record.

Guests can be authenticated via their own credentials (Guest Portal) or by simply accepting terms (Hotspot Portal).

The switch (NAD) performs the redirection based on the 'url-redirect' attribute provided by ISE in the RADIUS access-accept.

The 'Called-Station-ID' attribute, which typically contains the SSID or the Switch Port ID, allows ISE to identify where the connection attempt originated.

If the client is in the Webauth state on the WLC but the portal doesn't load, the issue is typically that the DNS resolution of the ISE FQDN is failing for the client or the WLC is not passing the redirect URL correctly.

It forces the guest account status to be 'pending' until a sponsor manually updates it to 'approved', preventing network access until that happens.

This attribute tells the NAD which ACL to use to determine which packets should be redirected and which should be allowed to proceed without redirection (e.g., DNS, DHCP, and traffic to ISE).

Change of Authorization (CoA) is the mechanism used by RADIUS to update an active session.

If the Redirect ACL is not properly configured to exclude the ISE PSN IP, the traffic to the ISE portal might get redirected again, causing a loop.

The sponsor portal is used by internal users to manage the lifecycle of guest accounts, such as creating, approving, or extending them.

The Cisco-AV-Pair 'url-redirect' is the standard attribute used in a RADIUS Accept message to inform the switch to redirect web traffic to the ISE guest portal.

Authorization Profiles define the permissions for the user. By assigning a specific dACL that permits access to the printer, you allow that traffic.

LWA requires the NAD to act as the web server for the captive portal, meaning the switch handles the HTTP request interception directly, unlike CWA where the endpoint is redirected to ISE.

The Guest Flow setting determines how the guest session is handled by the ISE, specifically linking the authorization profile to the appropriate portal type.

ISE portals allow for extensive customization of the UI, including the text displayed and the inclusion of specific fields like terms of use or registration forms.

Guest types allow you to define common parameters like account duration, password requirements, and access permissions that can be applied to guest accounts.

The 'Live Logs' in ISE provide real-time visibility into authentication attempts, including the specific failure reason (e.g., 'invalid credentials', 'user account expired').

The 'Pending' state indicates that the sponsor or an administrator has not yet approved the account creation request, which is a common security feature in guest access flows.

The guest workflow typically involves the guest user, a sponsor who validates the access, and the ISE engine that enforces the policy.

CWA requires a properly configured redirect ACL on the NAD and a corresponding authorization profile in ISE that points the client to the portal.