What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

Setting the NAC State option to SNMP NAC (Network Access Control) uses SNMP for communication, which is not the mechanism for Central Web Authentication with ISE; CWA relies on RADIUS.

Setting the NAC State option to RADIUS NAC on the WLC instructs it to use RADIUS for Network Access Control (NAC) authentication and authorization, which is essential for integrating with Cisco ISE for Central Web Authentication. This configuration ensures the WLC correctly redirects web authentication requests to ISE.

The radius-server vsa send authentication command is typically used on a switch/router to send vendor-specific attributes (VSAs) during authentication, but it is not the primary configuration for CWA on a WLC itself.

The ip access-group webauth in command is used for applying access lists on a wired network device for web authentication, not the primary configuration for CWA on a WLC.