Captive portal (CWA) the guest network's bouncer

Authentication that lives in the network, not the AP

Central Web Authentication separates joining from being authorized. The client associates to an open guest SSID and the controller runs MAC Authentication Bypass to a RADIUS server (Cisco ISE), which replies with provisional access: a redirect ACL that permits only DHCP, DNS and the portal, plus a URL to send the browser to. The user's credentials never touch the access point — they terminate at ISE.

When the user logs in or accepts the terms, ISE issues a Change of Authorization back to the controller, which re-evaluates the same session and applies full access. Nothing about the radio link changed; only permission did.

Where it breaks, and the Wi-Fi 6E successor

Two failures dominate CWA tickets, and the plate replays both: a redirect-ACL whose name ISE sends but the controller never defined (the client onboards into a black hole), and a Change of Authorization blocked by a firewall on UDP 1700 (the user logs in but access never opens). On a Wi-Fi 5 open SSID the link itself is cleartext, so the portal's HTTPS is the only thing protecting credentials — which is exactly why the Wi-Fi 6E plate runs the same flow over an OWE-encrypted link.