Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

Configure ISE for central web authentication

Updated: September 14, 2026

Want to summarize with AI?

Log in

Explains how to configure ISE for central web authentication.

Create authorization profiles (GUI)

Define authorization profiles that control network access through URL filters using the GUI.

Procedure

  1. Login to the Cisco Identity Services Engine (ISE). Click Policy, and click Policy Elements.

  2. Click Results.

  3. Expand Authorization, and click Authorization Profiles.

  4. Click Add to create a new authorization profile for URL filter.

  5. In the Name field, enter a name for the profile. For example, CentralWebauth.

  6. Select ACCESS_ACCEPT from the access type drop-down list.

  7. In the Advanced Attributes Setting section, select Cisco:cisco-av-pair from the drop-down list.

  8. Enter these parameters one by one and click (+) icon after each of them:

    • url-filter-preauth=<preauth_filter_name>

    • url-filter-postauth=<postauth_filter_name>

    For example,

    
Cisco:cisco-av-pair = url-filter-preauth=urllist_pre_cwa
Cisco:cisco-av-pair = url-filter-postauth=urllist_post_cwa

  9. Verify contents in the attributes details section and click Save.

Map authorization profiles to authentication rule (GUI)

Define rules that determine how authentication requests are processed by mapping authorization profiles to authentication criteria in the Policy interface using the GUI.

Procedure

  1. In the Policy > Authentication page, click Authentication.

  2. Enter a name for your authentication rule.

    For example, MAB.

  3. In the If condition field, select the plus (+) icon.

  4. Choose Compound condition , and choose WLC_Web_Authentication.

  5. Click the arrow located next to and ... in order to expand the rule further.

  6. Click the + icon in the Identity Source field, and choose Internal endpoints.

  7. Select Continue from the 'If user not found' drop-down list.

    This option allows a device to be authenticated even if its MAC address is not known.

  8. Click Save.

Map authorization profiles to authorization rule (GUI)

Map an authorization profile to an authorization rule to control network access permissions based on selected identity and condition attributes using the GUI.

Procedure

  1. Click Policy > Authorization. In the Rule Name field, enter a name.

    For example, CWA Post Auth.

  2. In the Conditions field, select the plus (+) icon.

  3. Select the Identity Groups area to view from the drop-down list. Choose User Identity Groups > user_group.

  4. Click the plus (+) sign located next to and ... in order to expand the rule further.

  5. In the Conditions field, select the plus (+) icon. Choose Compound Conditions, and choose to create a new condition.

  6. From the settings icon, select Add Attribute/Value from the options.

  7. In the Description field, select Network Access > UseCase as the attribute from the drop-down list. Choose the Equals operator.

  8. From the right-hand field, choose GuestFlow.

  9. In the Permissions field, select the plus (+) icon to select a result for your rule.

    You can choose Standard > PermitAccess option or create a custom profile to return the attributes that you like.