nerdexam
Cisco

300-430 · Question #257

Refer to the exhibit. A company is implementing Cisco ISE and IBN for their WLAN. The pictured IBN profile is applied to BYOD devices that are not registered to the Mobile Device Manager. Which advanc

The correct answer is B. allow AAA override. Allow AAA Override must be enabled on the WLAN so the WLC accepts dynamic policy attributes such as VLAN assignments pushed by Cisco ISE during 802.1X authentication.

Wireless Security and Mobility

Question

Refer to the exhibit. A company is implementing Cisco ISE and IBN for their WLAN. The pictured IBN profile is applied to BYOD devices that are not registered to the Mobile Device Manager. Which advanced setting must be enabled on the WLAN to allow the policy to work correctly?

Exhibit

300-430 question #257 exhibit

Options

  • Astatic IP tunneling
  • Ballow AAA override
  • CRADIUS profiling
  • DAironet IE

How the community answered

(68 responses)
  • A
    3% (2)
  • B
    79% (54)
  • C
    6% (4)
  • D
    12% (8)

Why each option

Allow AAA Override must be enabled on the WLAN so the WLC accepts dynamic policy attributes such as VLAN assignments pushed by Cisco ISE during 802.1X authentication.

Astatic IP tunneling

Static IP tunneling allows clients using static IP addresses to be tunneled to the controller but has no bearing on whether ISE-supplied authorization attributes are applied.

Ballow AAA overrideCorrect

When Cisco ISE applies an IBN authorization profile that returns RADIUS attributes such as a VLAN ID or ACL to redirect BYOD devices, the WLC must have Allow AAA Override enabled on the WLAN to accept and apply those attributes - without it, the WLC ignores the RADIUS-supplied policy and the IBN profile has no effect.

CRADIUS profiling

RADIUS profiling enables the WLC to send device information to ISE for profiling purposes, but it does not control whether the WLC honors AAA-supplied policy overrides.

DAironet IE

Aironet IE inserts Cisco-proprietary information elements into beacon and probe frames for client capability discovery and is unrelated to AAA policy enforcement.

Concept tested: AAA Override for dynamic ISE policy enforcement on WLC

Source: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/configuring_aaa_override.html

Topics

#ISE#AAA override#BYOD policy#IBN profile

Community Discussion

No community discussion yet for this question.

Full 300-430 Practice