Local web authentication (LWA) and central web authentication (CWA) are two mechanisms that are used to redirect users to a web portal to authenticate to ISE for guest services.
Both methods involve the use of a redirect access control list (ACL) that allows the user to access only the web portal URL and blocks all other traffic until the user is authenticated.
The difference between LWA and CWA is where the web portal and the authentication logic are hosted.
* LWA: The web portal and the authentication logic are hosted on the wireless LAN controller (WLC).
The WLC sends a RADIUS access-accept message to the network access device (NAD) along with the redirect ACL and the web portal URL.
The NAD then redirects the user to the web portal on the WLC, where the user enters their credentials. The WLC verifies the credentials with the ISE and grants or denies access to the user.
The advantage of LWA is that it does not require any configuration on the ISE, but the disadvantage is that it does not support advanced features such as posture assessment, profiling, or authorization policies.
* CWA: The web portal and the authentication logic are hosted on the ISE.
The WLC sends a RADIUS access-challenge message to the NAD along with the redirect ACL and the web portal URL. The NAD then redirects the user to the web portal on the ISE, where the user enters their credentials. The ISE verifies the credentials and sends a RADIUS access-accept message to the WLC with the authorization profile and the final ACL. The WLC then applies the authorization profile and the final ACL to the user session. The advantage of CWA is that it supports advanced features such as posture assessment, profiling, or authorization policies, but the disadvantage is that it requires more configuration on the ISE.
References:
* Configure Guest Access
* Web Authentication Redirection to Original URL
* Configure Local Web Authentication with External Authentication