A Cisco ISE administrator is setting up Central Web Authentication to be used for user endpoint authentication. The client cannot reach the guest portal to log in and gain access, but DNS is functioni

Cisco ISE's web-based portals (like the Guest Portal, My Devices Portal, etc.) typically listen on TCP port 8443 for HTTPS traffic. If a firewall between the client and the ISE Policy Service Node is blocking this port, clients will be unable to access the portal even if DNS is resolving correctly.

HTTP to HTTPS redirection is configured on the Network Access Device (NAD) (e.g., switch or WLC) to redirect initial HTTP requests to the ISE portal. While important for the CWA flow, it's not the primary reason a client 'cannot reach' the portal if DNS is working, implying a connectivity issue to the portal's port.

The guest portal, by default, listens on TCP/8443. This is a standard configuration and not something an administrator must additionally configure to make it listen on this port.

Allowing redirection from any client IP range is generally configured on the NAD to ensure all clients can be redirected to ISE, but it does not address the fundamental issue of the client being unable to reach the portal's listening port on the ISE server.