An engineer is configuring Central Web Authentication in Cisco ISE to provide guest access. When an authentication rule is configured in the Default Policy Set for the Wired_MAB or Wireless_MAB…

ACCEPT would grant access immediately if the user is not found, bypassing the guest portal, which is incorrect for guest access workflows.

DROP would discard the authentication request, preventing the user from even reaching the guest portal, which is not the desired outcome for guest access.

REJECT would deny access to the user if not found, preventing the guest portal redirection, which is contrary to the purpose of guest access.

For Central Web Authentication (CWA) or guest access, the initial MAB authentication is often a 'dummy' lookup for the endpoint's MAC address. If the MAC is not found, which is expected for new guests, the 'if user not found' action needs to be CONTINUE, allowing the process to move to a subsequent authorization rule or policy that triggers redirection to the guest portal.