Refer to the exhibit. An engineer is configuring Cisco ISE for guest services and needs any unregistered guests redirected to the guest portal for authentication, then have a CoA provide them full…

For unregistered guests to be redirected to a guest portal, the authorization rule responsible for the initial redirect must correctly identify them. The absence of an appropriate `Guest_Flow` related condition (e.g., `Session:GuestFlow NOT_EQUALS Guest`) in that policy line prevents the rule from accurately targeting and redirecting unregistered guests to the portal.

The `Network_Access_Authentication_Passed` condition is typically used in the subsequent authorization rule to grant full access after successful portal authentication, so it is necessary for guest services.

The initial 'Permit Access' result for guest redirection is usually restricted access (e.g., a redirect ACL), while full access is granted after portal authentication and CoA, so this choice misunderstands the flow.

While incorrect policy order is a common failure, the specific issue described is a missing condition within the redirect policy line itself, rather than the relative placement of distinct policy lines.