	1.	Login to the Cisco Identity Services Engine (ISE). Click Policy, and click Policy Elements.
	2.	Click Results.
	3.	Expand Authorization, and click Authorization Profiles.
	4.	Click Add to create a new authorization profile for URL filter.
	5.	In the Name field, enter a name for the profile. For example, CentralWebauth.
	6.	Select ACCESS_ACCEPT from the access type drop-down list.
	7.	In the Advanced Attributes Setting section, select Cisco:cisco-av-pair from the drop-down list.
	8.	Enter these parameters one by one and click (+) icon after each of them: url-filter-preauth=<preauth_filter_name> url-filter-postauth=<postauth_filter_name> For example, `Cisco:cisco-av-pair = url-filter-preauth=urllist_pre_cwa Cisco:cisco-av-pair = url-filter-postauth=urllist_post_cwa`
	9.	Verify contents in the attributes details section and click Save.

Map authorization profiles to authentication rule (GUI)

Define rules that determine how authentication requests are processed by mapping authorization profiles to authentication criteria in the Policy interface using the GUI.

Procedure

	1.	In the Policy > Authentication page, click Authentication.
	2.	Enter a name for your authentication rule. For example, MAB.
	3.	In the If condition field, select the plus (+) icon.
	4.	Choose Compound condition , and choose WLC_Web_Authentication.
	5.	Click the arrow located next to and ... in order to expand the rule further.
	6.	Click the + icon in the Identity Source field, and choose Internal endpoints.
	7.	Select Continue from the 'If user not found' drop-down list. This option allows a device to be authenticated even if its MAC address is not known.
	8.	Click Save.

Map authorization profiles to authorization rule (GUI)

Map an authorization profile to an authorization rule to control network access permissions based on selected identity and condition attributes using the GUI.

Procedure

	1.	Click Policy > Authorization. In the Rule Name field, enter a name. For example, CWA Post Auth.
	2.	In the Conditions field, select the plus (+) icon.
	3.	Select the Identity Groups area to view from the drop-down list. Choose User Identity Groups > user_group.
	4.	Click the plus (+) sign located next to and ... in order to expand the rule further.
	5.	In the Conditions field, select the plus (+) icon. Choose Compound Conditions, and choose to create a new condition.
	6.	From the settings icon, select Add Attribute/Value from the options.
	7.	In the Description field, select Network Access > UseCase as the attribute from the drop-down list. Choose the Equals operator.
	8.	From the right-hand field, choose GuestFlow.
	9.	In the Permissions field, select the plus (+) icon to select a result for your rule. You can choose Standard > PermitAccess option or create a custom profile to return the attributes that you like.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.