Foreign
1. UDP/1812-1813 open to ISE --> foreign receives RADIUS redirect from ISE
2. WLAN Layer 2 security --> set to none
3. pre-authentication ACL can be used to apply an ACL
Reference:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design- Guide/Enterprise_Mobility_8-1_Deployment_Guide/WirelessNetwork_GuestAccessService.pdf
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless- controllers/215661-in-depth-look-into-client-profiling-on-9.html#anc1