For central web authentication with Cisco ISE in a Cisco AireOS WLC environment using auto-anchor for the guest network, the foreign WLC must have UDP ports 1812 and 1813 open to ISE for RADIUS authentication and accounting. Additionally, a downloadable preauth ACL on ISE is required to define the permissions for the guest user before authentication, and a local preauth ACL on the WLC is needed to restrict or allow traffic prior to authentication. References: CCNP Enterprise Wireless Design ENWLSD 300-425 and Implementation ENWLSI 300-430 Official Cert Guide, particularly the chapters on WLC configuration for guest access and integration with Cisco ISE for security and access control.