Refer to the exhibit. An ACL is configured to restrict access for BYOD clients. The ACL must redirect devices to the guest portal. To which two devices on the local network must the ACL allow access o

The RADIUS server handles back-end authentication decisions between the WLC and the policy engine; it does not need to be directly reachable by the BYOD client in a web redirect ACL.

DNS access is essential in a web-redirect scenario because the client browser must resolve the hostname in the guest portal URL before the HTTP redirect can succeed. If the ACL blocks DNS traffic on UDP/TCP port 53, the client cannot determine the IP address of the portal and the entire redirect flow fails. The ACL must explicitly permit traffic to the DNS server.

Cisco ISE hosts the guest and BYOD onboarding portals that the redirect ACL is designed to direct clients toward. The ACL must explicitly permit HTTP and HTTPS traffic from the client to the ISE Policy Service Node interface so the portal page can load. Without this permit rule, the client will receive the redirect response but will get no reply from the portal server.

The SNMP server is used for network management and monitoring and plays no role in the client-side portal redirect or BYOD authentication flow.

The WLC enforces the ACL and terminates the wireless session; the client communicates with it implicitly through the wireless association, so no explicit ACL permit rule to the WLC is needed to enable the redirect.