300-120 WLSI: Implementing Cisco Wireless Advanced Solutions

Guest HTTPS traffic must be permitted to the virtual interface IP address because the controller uses that address as the redirect destination for the Web Authentication login page. With CPU ACLs that block HTTP/HTTPS, Cisco requires an allow rule for the virtual IP on TCP port 443 when secure web authentication is enabled. The controller management IP is the strongest distractor, but it is the management-plane address rather than the guest web-authentication redirect address.