Web Authentication and Guest Services
Web Authentication and Guest Services
This domain tests how unauthenticated endpoints are redirected, how guests obtain accounts, and how sponsor approval and guest portals fit into authorization. Expect questions on central web authentication (CWA), guest portal types, guest types, sponsor groups, AUP, and device registration.
Core rules
- Web authentication redirects an endpoint to an ISE portal; CWA commonly uses MAB first, then a redirect and CoA after login.
- The 'Web Authentication' identity source is used for the portal login; guest accounts normally come from the guest store, not AD.
- Guest portal types include self-registration, sponsored, and hot spot. Hot spot typically presents only an AUP and no credentials.
- Guest types define login options, password policy, sponsor approval, and account duration. Sponsor groups and sponsor accounts control who can create or approve guests.
- AUP acceptance, device registration, and time profiles are portal settings that affect the guest flow and authorization.
- After portal login, an authorization rule returns the guest VLAN/DACL; CoA moves the session from the redirect state to the guest access state.
Worked example
A visitor connects to SSID Guest. The WLC sends RADIUS to ISE; MAB fails, and the authorization result is 'Guest Redirect' with a URL. The guest portal is self-registration with sponsor approval and device registration enabled. The visitor creates an account, accepts the AUP, and registers the device; the sponsor approves in the sponsor portal. The guest logs in, and ISE matches the authorization rule Guest-Authenticated -> Guest_Access, which returns VLAN 200 and a restricted DACL. ISE sends CoA, and the endpoint is reauthorized. If sponsor approval is required but the sponsor group has no approver, the account remains pending and the guest never reaches the Guest-Authenticated rule. If the portal certificate is untrusted, the redirect may fail before login.
Traps
- Treating hot spot as self-registration; hot spot has no account creation.
- Forgetting sponsor approval or sponsor group membership.
- Using AD as the guest identity source when accounts are local.
- Portal certificate/DNS errors that break the redirect.
- Skipping CoA so the endpoint stays in the redirect state.
- Device registration limits and AUP not being enforced.