An engineer is configuring wireless guests using Cisco CWA. When a device connects, it must be redirected to the WebAuth, but this was failing. What must be configured for the device to be redirected

In a CWA deployment using a foreign-anchor topology, the redirect ACL name returned by the AAA server in the Access-Accept message must be configured locally on the anchor WLC. Without a matching ACL on the anchor controller, the WLC cannot enforce the redirect policy and the client will not be sent to the WebAuth portal.

DHCP option 7 specifies log server addresses and has no role in web authentication redirection for CWA deployments.

Allowing ICMP toward the portal is not a requirement for CWA redirection - the redirect mechanism is HTTP-based and does not depend on ICMP reachability.

Removing a CN entry from the SAN field is a certificate management action unrelated to the ACL-based redirect configuration required for CWA.