A hospital is switching on BYOD onboarding for its clinical access switches. Clients must receive an address by DHCP, resolve the portal name with the internal DNS server at 10.10.0.10, and reach the onboarding portal on PSN 10.10.50.10 over TCP 80 and 443 while staying blocked from everything else until onboarding finishes. Which pre-authentication ACL belongs on those access ports?
Select an answer to reveal the explanation.
Short Explanation
Your pre-authentication ACL works like a guest list, letting clients use DHCP, DNS at 10.10.0.10, and TCP ports 80 and 443 to the portal PSN at 10.10.50.10. You then deny everything else until onboarding is complete.
Full Explanation
The pre-authentication ACL permits only the services an endpoint genuinely needs before onboarding finishes. DHCP gives the client its address, a DNS query to the internal resolver lets the browser reach the portal by name, and TCP 80 and 443 to the PSN allow the specified portal traffic; the trailing deny blocks other flows until authorization changes. This ACL is distinct from the switch's URL-redirect ACL, which identifies traffic to redirect; its exact configuration depends on the platform and design. Opening HTTP and HTTPS to every reachable destination would allow access beyond the portal, contrary to the requirement. Omitting DNS would prevent a client that relies on the portal name from resolving it. Opening all TCP traffic to the ISE management subnet would expose services beyond those specified. Enrollment designs may also require additional permits, such as for OCSP or NTP, so verify the requirements for the deployment. Test from a BYOD client by renewing its lease, resolving the portal name, checking that the portal loads, and reviewing ACL counters.