Which configuration is required in the Cisco ISE authentication policy to allow Central Web Authentication?

The correct answer is A. MAB and if user not found, continue. Central Web Authentication (CWA) relies on MAC Authentication Bypass (MAB) as the authentication method. When an endpoint connects, ISE checks its MAC address against the internal endpoint database. If the MAC is not found (i.e., unknown endpoint), the policy must be set to…

Policy Enforcement

Question

Options

AMAB and if user not found, continue
BMAB and if authentication failed, continue
CDot1x and if user not found, continue
DDot1x and if authentication failed, continue

How the community answered

(30 responses)

A
90% (27)
B
3% (1)
C
7% (2)

Explanation

Central Web Authentication (CWA) relies on MAC Authentication Bypass (MAB) as the authentication method. When an endpoint connects, ISE checks its MAC address against the internal endpoint database. If the MAC is not found (i.e., unknown endpoint), the policy must be set to 'continue' rather than 'reject'. This 'continue' action allows the unknown device to fall through to the authorization policy, where ISE can redirect it to the captive web portal for guest or sponsor authentication. Without 'if user not found, continue,' unknown devices would simply be denied access and never reach the web portal.

Topics

#Cisco ISE#Central Web Authentication (CWA)#Authentication Policy#MAC Authentication Bypass (MAB)

Community Discussion

No community discussion yet for this question.

Full 300-715 Practice