The switch must have a redirect ACL configured locally. It is referenced by name in the authorization profile. The ACL permits the traffic that should be redirected, and denies the traffic that will not be redirected. This ACL will typically deny basic services, such as DHCP and DNS, and the communication between the Network Admission Control (NAC) agent and the Cisco Identity Service Engine (ISE).
When configuring the redirect ACL locally on the switch, you have to ensure that the ACL configured on the Cisco Identity Services Engine (ISE) matches the local ACL defined on the switch. This is because the redirect ACL configured on the switch is referenced by an authorization profile on the Cisco ISE.
Endpoints must be redirected to the client provisioning portal to install the agent suitable for them.
This redirection is configured jointly on the network access device and the Cisco Identity Services Engine (ISE), not solely on the Cisco ISE.
The redirect ACL configured on the switch is referenced by an authorization profile on the Cisco Identity Service Engine (ISE). It is not referenced by an authorization policy rule. The authorization profile is referenced by an authorization policy rule.