A typical self-registration guest lifecycle in Cisco ISE requires two separate Authorization Profiles to handle the user before and after authentication:
The Redirect Phase (Option C): When an unauthenticated guest first associates with the GUEST- WIFI SSID shown in image_039618.jpg, Cisco ISE needs to intercept their traffic. You must configure an Authorization Profile that passes the URL redirection attributes and a redirection ACL back to the WLC. This forces the user's web browser to load the self-registration guest portal.
The Access Phase (Option A): Once the user successfully registers and logs into the portal, Cisco ISE sends a Change of Authorization (CoA) to update the session. A second Authorization Profile must be configured to grant the endpoint full or limited internet access (typically by removing the redirection constraints and applying a standard permit policy).