A warehouse training room runs wired ports on a Cisco Catalyst switch. Guest devices must see a login page, ISE must validate the submitted credentials against Active Directory, and the switch must apply a restrictive ACL to the authenticated session on the port. The guest VLAN is isolated from the ISE portal service and reaches only the switch itself. Which web authentication design keeps the page reachable while still checking AD and filtering the session?
Select an answer to reveal the explanation.
Short Explanation
Local web auth keeps the login page on the switch, which is exactly what this isolated guest VLAN needs. The switch serves the form you submit, then sends your credentials to ISE, so Active Directory still does the checking. It's like a doorman who writes your name down and radios it in — the page itself never has to leave the site.
Full Explanation
Local web authentication puts the captive page on the network access device: the switch runs its own web server, presents the form, and forwards the submitted username and password to ISE in a RADIUS access request. Because the guest VLAN can reach the switch but is isolated from the portal service, that split keeps the browser flow on the network; ISE then checks Active Directory and returns the restrictive ACL in the access accept, which the switch applies to the authenticated session on the port. Central web authentication fails here because it relies on an HTTP redirect that carries the browser to an ISE-hosted portal, and this VLAN has no path to that portal. Web authentication backed by the switch's local username database still applies a restrictive ACL, but it bypasses the directory, so the identity is never checked against AD. Web authentication that finishes by granting full access to the guest VLAN leaves the session unrestricted and therefore misses the filtering requirement. Exam caveat: Cisco uses "local web auth" for a NAD-hosted page with AAA still handled by ISE, which is different from local AAA on the device. Practical check: from a laptop on the guest VLAN, confirm you can reach the switch but not the ISE portal, submit the form, and watch the restricted rule's hit counter climb.