I85PREP
⌘ K
ENWLSI 300-430 study materials
ENWLSI 300-430 study resources

ENWLSI 300-430: Implementing Cisco Wireless Guest Access

ENWLSI 300-430 · Work through your exam, one topic at a time.

All guide sections

Implementing Cisco Wireless Guest Access

The Implementing Cisco Wireless Guest Access domain tests open/web-authenticated WLANs, the choice between local and central web authentication, DMZ anchoring of guest traffic, and the ACL plumbing that lets an unauthenticated client reach a portal but nothing else.

Choosing the authentication model

  • Web passthrough - splash page only, no credentials; used for terms acceptance.
  • LWA (local web auth) - the controller hosts the portal and validates local net users, each with a lifetime and concurrent-session limit.
  • CWA (central web auth) - the portal lives on ISE; the client is MAB'd or guest-authenticated, then ISE sends a CoA that moves the client to its post-auth state.
  • Sleeping client timeout and per-user lifetime decide how long an idle guest can re-enter without re-authenticating.

Anchor tunneling

  • The foreign controller terminates the client's CAPWAP; guest data is carried in a mobility tunnel (EoIP over UDP 16666/16667) to the anchor in the DMZ, which owns the Internet egress and usually the DHCP scope.
  • The WLAN must exist on both controllers with identical SSID and security, both must share the same mobility group name, and the anchor must be added from the foreign controller. On Catalyst 9800 the anchoring is configured through the policy profile while the same WLAN/policy must exist on the anchor.

ACLs

  • The pre-auth ACL must permit DHCP, DNS and the portal/ISE before login. The post-auth ACL controls egress once the guest is authenticated. FlexConnect guest WLANs need the ACLs locally.

Worked example

Guests associate and receive a DMZ address, but guest.example.com never loads. Reasoning: because a DMZ-scope address arrived, the mobility tunnel is up and DHCP works. The failure is therefore in policy, not transport - the pre-auth ACL permits UDP 67/68 and DNS but not TCP 443 to the portal. After login, if traffic is still blocked, the post-auth ACL is the next suspect.

Traps that cost marks

  • Forgetting to create the WLAN on the anchor controller, or a mobility group name mismatch so no tunnel forms.
  • A pre-auth ACL that blocks DHCP, leaving clients stuck without an address.
  • An untrusted or expired portal certificate, so browsers refuse the redirect.
  • Session timers shorter than the guest stay, forcing repeated logins.