300-430 · Question #257
Refer to the exhibit. A company is implementing Cisco ISE and IBN for their WLAN. The pictured IBN profile is applied to BYOD devices that are not registered to the Mobile Device Manager. Which advanc
The correct answer is B. allow AAA override. Allow AAA Override must be enabled on the WLAN so the WLC accepts dynamic policy attributes such as VLAN assignments pushed by Cisco ISE during 802.1X authentication.
Question
Refer to the exhibit. A company is implementing Cisco ISE and IBN for their WLAN. The pictured IBN profile is applied to BYOD devices that are not registered to the Mobile Device Manager. Which advanced setting must be enabled on the WLAN to allow the policy to work correctly?
Exhibit
Options
- Astatic IP tunneling
- Ballow AAA override
- CRADIUS profiling
- DAironet IE
How the community answered
(68 responses)- A3% (2)
- B79% (54)
- C6% (4)
- D12% (8)
Why each option
Allow AAA Override must be enabled on the WLAN so the WLC accepts dynamic policy attributes such as VLAN assignments pushed by Cisco ISE during 802.1X authentication.
Static IP tunneling allows clients using static IP addresses to be tunneled to the controller but has no bearing on whether ISE-supplied authorization attributes are applied.
When Cisco ISE applies an IBN authorization profile that returns RADIUS attributes such as a VLAN ID or ACL to redirect BYOD devices, the WLC must have Allow AAA Override enabled on the WLAN to accept and apply those attributes - without it, the WLC ignores the RADIUS-supplied policy and the IBN profile has no effect.
RADIUS profiling enables the WLC to send device information to ISE for profiling purposes, but it does not control whether the WLC honors AAA-supplied policy overrides.
Aironet IE inserts Cisco-proprietary information elements into beacon and probe frames for client capability discovery and is unrelated to AAA policy enforcement.
Concept tested: AAA Override for dynamic ISE policy enforcement on WLC
Source: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/configuring_aaa_override.html
Topics
Community Discussion
No community discussion yet for this question.
