When Web Policy 'Authentication' is chosen under Layer 3 Security for a WLAN, which device serves the web authentication portal to clients?

When Web Policy 'Authentication' is selected under Layer 3 Security for a WLAN, the local Wireless LAN Controller (WLC) acts as the web authentication portal. This means the WLC itself hosts the login page that clients are redirected to for authentication. The local WLC intercepts HTTP/HTTPS traffic from unauthenticated clients and presents the web portal. An ISE server (Identity Services Engine) or RADIUS server would typically be used for backend authentication and authorization once the user submits credentials on the portal, but they do not host the portal itself in this specific configuration. An anchor WLC is used in guest deployments for centralized data forwarding and security, not for hosting the initial web authentication portal for local mode WLANs.