An SSID is set up with central web authentication using Cisco ISE. The new SSID uses guest tunneling from the foreign controller to the anchor controller. Which device must be configured on ISE as…

The foreign controller handles only 802.11 association and CAPWAP control; once the client is tunneled to the anchor, the foreign controller plays no role in L3 authentication and does not send RADIUS requests to ISE.

The authentication server (ISE) is the RADIUS server that receives and processes authentication requests - it is the destination of RADIUS traffic, not the originating device making requests.

In a guest tunneling architecture, all client traffic is tunneled from the foreign controller to the anchor controller via a mobility EoIP tunnel; the anchor controller terminates client sessions, performs the L3 web authentication redirect, and sends RADIUS Access-Request messages to ISE - therefore ISE must have the anchor controller configured as the Network Access Device (NAD/AAA client), not the foreign controller.

APs operate at Layer 2 in a CAPWAP split-MAC architecture and have no visibility into L3 web authentication flows; they never initiate RADIUS requests and are never registered as AAA clients in ISE.