nerdexam
Cisco

300-365 · Question #69

A client wants to put wireless users on different VLANs while using one SSID. Which two methods accomplish this goal? (Choose two.)

The correct answer is A. Use ACS as the RADIUS server. B. Configure aaa override on Cisco WLC WLAN. Assigning wireless users to different VLANs from a single SSID requires both a RADIUS server capable of returning VLAN attributes and AAA override enabled on the WLC WLAN to apply those attributes per client.

WLAN Security Deployment

Question

A client wants to put wireless users on different VLANs while using one SSID. Which two methods accomplish this goal? (Choose two.)

Options

  • AUse ACS as the RADIUS server.
  • BConfigure aaa override on Cisco WLC WLAN.
  • CConfigure similar SSIDs with different VLANs.
  • DConfigure the same WLAN on ID 1 and 17.
  • EConfigure the Cisco WLC internal RADIUS server.

How the community answered

(43 responses)
  • A
    81% (35)
  • C
    7% (3)
  • D
    2% (1)
  • E
    9% (4)

Why each option

Assigning wireless users to different VLANs from a single SSID requires both a RADIUS server capable of returning VLAN attributes and AAA override enabled on the WLC WLAN to apply those attributes per client.

AUse ACS as the RADIUS server.Correct

Cisco ACS as the RADIUS server can return the Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes in the Access-Accept message, instructing the WLC to assign a specific VLAN to each authenticated client.

BConfigure aaa override on Cisco WLC WLAN.Correct

Enabling AAA override on the WLC WLAN tells the controller to honor the VLAN and other policy attributes returned by the RADIUS server, overriding the single static VLAN configured on the WLAN interface and enabling per-user VLAN assignment over one SSID.

CConfigure similar SSIDs with different VLANs.

Configuring similar SSIDs with different VLANs uses multiple SSIDs rather than a single SSID, which does not meet the stated requirement.

DConfigure the same WLAN on ID 1 and 17.

Configuring the same WLAN on IDs 1 and 17 does not create per-user VLAN assignment and is unrelated to the mechanism for segmenting users across VLANs from a single SSID.

EConfigure the Cisco WLC internal RADIUS server.

The Cisco WLC internal RADIUS server does not support returning VLAN assignment attributes and cannot fulfill the role of a full-featured AAA server for dynamic VLAN assignment.

Concept tested: Single SSID multi-VLAN assignment via AAA override and RADIUS

Source: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/b_cg810_chapter_010111.html

Topics

#AAA override#VLAN segmentation#single SSID#RADIUS VLAN assignment

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-365 Practice