A logistics company is adding guest Wi-Fi at three warehouses, and its design rules say the terms-of-use login page and its processing must run on the ISE node itself, with guest accounts kept in ISE's local guest database. The architect must explain how the guest browser reaches that page and who validates each login. Which ISE web authentication behavior meets both design rules?
Select an answer to reveal the explanation.
Short Explanation
With central web authentication, your controller sends the browser to a login page hosted and processed on ISE, like a front desk sending guests to the right check-in desk. ISE then checks each login against its own local guest database.
Full Explanation
In central web authentication, ISE returns web redirection attributes in its RADIUS response. The controller uses them to redirect the guest's browser to the portal running on ISE, and the browser submits the login to ISE. ISE validates the credentials against its guest database and, after successful authentication, sends a change of authorization (CoA) to the controller to apply the guest's authorized access. Local web authentication fails the hosting rule because the controller renders the login page and forwards submitted credentials to ISE over RADIUS. External web authentication fails the hosting rule because a separate server hosts the portal. Using an external identity source fails the local guest database rule, even if ISE hosts the page. In a multi-node deployment, ensure the guest portal is configured on the node serving the page and that guest account data is available to it.