FQDN ACL on 3650/3850 with centralized webauth

Question

Hi.
I'm trying to understand and use the fqdn acl on the IOS-XE platform. Has anyone tried this?
What Im trying to achieve is allowing android clients to download the native supplicant software from Google Play store without having a ACL with alot of IP addresses. The documentation of fqdn acl is very slim and not so much help. 
Desired result: Clients are allowed to go to play.google.com and android.clients.google.com, but everything else has to be redirected to ISE. 
ip access-list extended NSP
 deny   udp any eq bootps any
 deny   udp any any eq bootpc
 deny   udp any eq bootpc any
 deny   udp any any eq domain
 deny   tcp any any eq domain
 deny   icmp any any
 deny   ip any host A.B.C.D
 permit ip any any
 exit
passthru-domain-list NSP
match play.google.com
match android.clients.google.com
exit
access-session passthru-access-group NSP passthru-domain-list NSP
Host A.B.C.D is the ISE node. I've verified that the client gets the ACL, but it isnt allowed to go to play.google.com so the passthru is misconfigured or doenst work. 
Im running ISE 1.3 with 3650. 

Answer 1

Hi Ian,
It is a long post & many questions 
I will try to answer as much as I can.
"I have not configured a Mobility Oracle (MO) since I only have one MC and the GA. If it is advisable to do, then would it be best to enable the MO on the MC or GA?"
No, you don't want MO unless your set-up is extremely large (it is similar to use of BGP route reflector to reduce complexity of having full mesh)
"My initial thoughts with the Mobility Agents (MA) was that it was a simple case of pointing the 3850s to the MC and the wireless service (WLAN) configurations would automatically appear. Through configuration tests and converged access deployment guides, I now believe this to no longer be the case. Therefore, for MAs to advertise wireless services they have to be individually configured. Am I correct with my thoughts?"
Yes, you have to configure your WLAN configuration in MC & MA, it won't automatically propagate to MA.
"For the deployment of WebAuth wireless services on the MA 3850 switches, I have not managed to find a guide that explains how an MA anchors wireless clients to the GA. I have found documents that describe combined MC/MA configurations to GA, but not when the 3850 is just an MA"
I have not configured this, but this is my understanding.  You would configure MA WLAN  pointing to GA as mobility anchor. Still traffic will transit through MC as it will manage MA & SPG (any thing outside SPG should go through MC)
Here is the some useful reference information I gathered over the timel. (white paper is the one you should read to cover everything)
https://supportforums.cisco.com/discussion/11984726/converged-access-design-information
HTH
Rasika
*** Pls rate all useful responses ****