An engineer must implement a CPU ACL that blocks web management traffic to the controller, but they also must allow guests to reach a Web Authentication Redirect page. To which IP address is guest client HTTPS traffic allowed for this to work?

The Cisco Wireless LAN Controller (WLC) uses its configured virtual interface IP address specifically for Layer 3 security functions, most notably the guest web authentication portal. When a guest client attempts to access the internet, the WLC intercepts the HTTP/HTTPS traffic and redirects the user's browser to a login page. This login page is hosted on and presented from the WLC's virtual IP address. Therefore, even if a CPU ACL is configured to block web management access to the controller's management IP, it must contain an explicit rule to permit traffic destined for the virtual interface IP to allow the web authentication redirect to succeed.

A. DNS server IP: While DNS is required for name resolution, the initial captive portal redirect is an IP-level interception to the WLC's virtual IP, not the DNS server's IP.
B. controller management IP: The primary goal stated in the question is to block web management traffic, which is accessed via the management IP. Allowing traffic here would contradict the requirement.
D. client interface IP: This IP address acts as the gateway for the client VLAN but does not host the web authentication page; that function is served by the virtual IP.

1. Cisco Wireless LAN Controller Configuration Guide, Release 8.10, "Information About the Virtual Interface" section: "The virtual interface is used by the system to support mobility management, DHCP relay, and Layer 3 security such as guest web authentication... The controller's virtual interface IP address is the address that is seen by wireless clients during the web authentication process."

2. Cisco Technical Note, "Understand and Configure CPU ACLs on Wireless LAN Controllers," Document ID: 113242, "Web-Authentication" section: "The WLC uses the virtual IP address for multiple functions, such as the built-in guest portal... If you want to block HTTP/HTTPS access to the management interface of the WLC, but still want the web-authentication to work, you need to deny traffic to the management interface IP address and allow traffic to the virtual IP address."

3. Cisco Press, "300-430 ENWLSI Official Cert Guide," Chapter 1, "Securing the Wireless Network," section on "CPU ACLs": This section explains that for web authentication to function while management access is blocked, an ACL rule must permit traffic to the virtual IP address on port 80/443. It explicitly states, "The key is to permit traffic to the virtual IP address, which is used for the web authentication process."