Cisco · ISE 3.3 · Lesson 7 of 12

CWA guest: the browser is the supplicant

A contractor has no 802.1X and no corporate MAC. The port does MAB, ISE returns a redirect URL + redirect ACL, the browser opens the Guest portal, then CoA gives limited internet. That is CWA, not old local web auth on the switch.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Contrast CWA vs LWA in one sentence.
Build an Authorization result with redirect ACL + portal.
Prove redirect then CoA in Live Logs.
Not leave the redirect ACL as permit-any.

The ticket

Guest SSID shows a certificate error or a blank page. Or the portal never appears because the redirect ACL blocked DNS. Helpdesk disabled MAB. Contractors now sit on the corporate VLAN.

Quick interview answer

CWA (Central Web Authentication): ISE owns the portal. First MAB Accept carries a URL redirect and a redirect ACL that permits DNS/DHCP/ISE and denies the rest. After login, CoA reapplies a guest dACL. LWA is a portal on the WLC/switch. PDF: ISE returns a redirect URL and an ACL that permits only what the captive flow needs.

Guest browser redirected to ISE portal — If DNS is not in the redirect ACL, the portal never loads. That is not “ISE is down.”

Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

CWA vs LWA

	CWA	LWA
Portal	ISE PSN	WLC/switch
First Accept	Redirect + ACL	Local intercept
After login	CoA from ISE	Device-local
Use	Wired + wireless guests in ISE shops	Legacy WLC-only

https://ise-pan.techclick-lab.in/admin

Training mock · not live

ISE Admin

Context VisibilityOperationsPolicyAdministration

Policy → Policy Elements → Results → Authorization → Authorization Profiles

Guest_Redirect

Web redirection

Centralized Web Auth

ACL

ACL_CWA_REDIRECT

Portal

When CWA

Unknown MAB, BYOD onboarding, or contractor SSID. Not for Priya’s managed laptop — she should do 802.1X.

How you build it

Side A — NAD
Redirect ACL on the switch/WLC: permit DNS, DHCP, PSN 8443/443; deny the rest (syntax is “what not to redirect” on Catalyst — verify your IOS train). Enable CoA.
Side B — ISE
Guest portal. Authz: IF unknown/guest SSID THEN Guest_Redirect. After login identity group Guest → dACL_GUEST_WEB.
Side C — prove
Two Live Log lines: first Redirect, then CoA / Guest Accept. Browser URL is the ISE FQDN, trusted cert.

Four CWA failures

1 · DNS denied

Portal hostname will not resolve. Add DNS to the redirect ACL.

2 · Portal cert name ≠ URL

Browser warn. SAN must be the PSN FQDN guests hit.

3 · No CoA

User logs in, still redirected forever.

4 · Redirect ACL = empty / any

Either no captive page or the whole internet before login.

How to prove it

Close the ticket only when

1) First log = CWA redirect. 2) Portal opens with a trusted name. 3) After login, CoA and guest dACL. 4) Guest cannot reach 10.20.30.41 HR.

Traps

Wrong	Right
Put guests in HR VLAN	Guest VLAN + web-only dACL
LWA on one WLC, CWA in ISE	Pick one model
Self-signed portal	Public or lab CA in the guest flow

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

ISE 3.3 guest / CWA authorization profiles.
Lab PDF — redirect URL + permit-only ACL.