There is one guest ssid too which has the psk + CWA setup as you said layer 3 will happen through anchor. Since redirection URL was pushed by ISE and on that I was able to see NAS device was foreign . So my guess was Ip addressing happens through anc...