To support Central WebAuth, the Change of Authorization (CoA) feature must be enabled on the network access devices (NADs). In the standard Remote Authentication Dial-In User Service (RADIUS) process, authorization specifications are sent to the NAD in an Access-Accept message in response to an Access-Request from the NAD. CoA allows Identity Services Engine (ISE) to send new authorization specifications when ISE recognizes the conditions have changed.
CoA does not require the NAD to solicit the authorization request.
To support Central WebAuth, the HTTP and HTTPS services must be enabled on the network access devices (NADs). These services are required at the Cisco IOS NAD so that the NAD can intercept web requests and redirect them to the Cisco Identity Services Engine (ISE). It is recommended that an "access-class" statement is applied to the HTTP service to limit which IP addresses are allowed to reach the management interface via HTTP or HTTPS.
To support Central WebAuth, a local ACL must be configured that is used to define the traffic that is to be redirected. Traffic denied by the ACL is not redirected. However, traffic that is permitted will be redirected. This local ACL is referenced by Identity Services Engine (ISE) by name in the authorization profile. The local ACL must be a named ACL. Numbered ACLs are not supported.
MAC Authentication Bypass (MAB) is an authentication option that allows certain systems that do not have an 802.1X supplicant to access the network while still maintaining a consistent configuration across switch access ports. It is not required to support Central WebAuth.
Multi-domain (MDA) mode is an 802.1X authentication mode that allows an IP phone and a single host behind the IP phone to authenticate independently. It is not required to support Central WebAuth.