# CWA guest: the browser is the supplicant

Source: https://ai.techclick.in/blog_cisco_ise_cwa_guest_portal
Markdown: https://ai.techclick.in/blog_cisco_ise_cwa_guest_portal.md
Publisher: Techclick Infosec Pvt Ltd

Central Web Authentication: redirect ACL + portal. Dummy guest on VLAN 60. Not LWA.

## The ticket

 Guest SSID shows a certificate error or a blank page. Or the portal never appears because the redirect ACL blocked DNS. Helpdesk disabled MAB. Contractors now sit on the corporate VLAN.

  Quick interview answer

  CWA  (Central Web Authentication): ISE owns the portal. First MAB Accept carries a URL redirect and a  redirect ACL  that permits DNS/DHCP/ISE and denies the rest. After login, CoA reapplies a guest dACL.  LWA  is a portal on the WLC/switch. PDF: ISE returns a redirect URL and an ACL that permits only what the captive flow needs.

  Hero · browser login

 If DNS is not in the redirect ACL, the portal never loads. That is not “ISE is down.”
  Lab data · dummy only
 PAN  ise-pan   10.10.10.20  · PSN  ise-psn1   10.10.10.21  · MnT  ise-mnt   10.10.10.22  · NAD  sw-access-01   10.10.10.2  · AD  dc01   10.20.30.10  · Priya  10.20.30.80   TECHCLICK\priya.hr  · printer  10.20.30.60 . Not a live customer.

## CWA vs LWA

     CWA  LWA

  Portal  ISE PSN  WLC/switch
  First Accept  Redirect + ACL  Local intercept
  After login  CoA from ISE  Device-local
  Use  Wired + wireless guests in ISE shops  Legacy WLC-only

     https://ise-pan.techclick-lab.in/admin

     Training mock · not live

       ISE Admin

       Context Visibility  Operations  Policy  Administration

       Policy → Policy Elements → Results → Authorization → Authorization Profiles

### Guest_Redirect

        Web redirection  Centralized Web Auth

  ACL  ACL_CWA_REDIRECT

  Portal  Sponsored Guest Portal

  DACL after login  dACL_GUEST_WEB

        Cancel  Save

   ISE guest / CWA authorization profiles. Training mock.

## When CWA

 Unknown MAB, BYOD onboarding, or contractor SSID. Not for Priya’s managed laptop — she should do 802.1X.

## How you build it

- #### Side A — NAD Redirect ACL on the switch/WLC: permit DNS, DHCP, PSN 8443/443; deny the rest (syntax is “what not to redirect” on Catalyst — verify your IOS train). Enable CoA.

- #### Side B — ISE Guest portal. Authz: IF unknown/guest SSID THEN Guest_Redirect. After login identity group Guest → dACL_GUEST_WEB.

- #### Side C — prove Two Live Log lines: first Redirect, then CoA / Guest Accept. Browser URL is the ISE FQDN, trusted cert.

## Four CWA failures

### 1 · DNS denied

 Portal hostname will not resolve. Add DNS to the redirect ACL.

### 2 · Portal cert name ≠ URL

 Browser warn. SAN must be the PSN FQDN guests hit.

### 3 · No CoA

 User logs in, still redirected forever.

### 4 · Redirect ACL = empty / any

 Either no captive page or the whole internet before login.

## How to prove it

  Close the ticket only when

 1) First log = CWA redirect. 2) Portal opens with a trusted name. 3) After login, CoA and guest dACL. 4) Guest cannot reach 10.20.30.41 HR.

## Traps

   Wrong  Right

  Put guests in HR VLAN  Guest VLAN + web-only dACL
  LWA on one WLC, CWA in ISE  Pick one model
  Self-signed portal  Public or lab CA in the guest flow

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       CWA portal is hosted on…

           ISE PSN
           MnT only
           AD
           The printer

       Correct:  a . Concept.

       Q2
       First CWA Accept usually carries…

           Redirect URL + redirect ACL
           Full HR dACL
           A PAN failover
           OSPF

       Correct:  a . PDF.

       Q3
       Portal never loads, ping to 1.1.1.1 fails, no DNS. First ACL check?

           Permit DNS in the redirect ACL
           Delete the NAD
           Disable CoA
           Remove PEAP

       Correct:  a . Failure 1.

       Q4
       User authenticates but stays on the portal. Likely?

           CoA not working
           Too much NTP
           pxGrid required for guests
           MAB disabled on purpose

       Correct:  a . Failure 3.

       Q5
       LWA vs CWA?

           LWA portal on WLC/switch; CWA portal on ISE
           They are identical
           CWA is only TACACS
           LWA is ISE-only

       Correct:  a . Table.

       Q6
       After guest login, HR app 10.20.30.41 should be…

           Blocked by guest dACL
           Automatically allowed
           Used as the portal
           The RADIUS server

       Correct:  a . Proof checklist.

       Check answers
       Reset

  Cisco ISE class series:   Personas  ·  First day  ·  NAD + RADIUS  ·  Policy sets  ·  Wired 802.1X  ·  MAB  ·  CWA / guest  ·  Profiling  ·  dACL vs VLAN  ·  Live logs  ·  vs Forescout  ·  Interview

## Sources

- ISE 3.3 guest / CWA authorization profiles.
- Lab PDF — redirect URL + permit-only ACL.

 Related:  ISE evidence desk  ·  session factory  ·  Forescout series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt