300-430 · Question #261
A customer recently upgraded the network to Cisco SD-Access. Cisco DNA Center manages the wireless network; all SSIDs are Fabric-enabled. Cisco DNA Center must be able to classify 揜 ogue on Wire" APs.
The correct answer is A. Configure all access switches to be managed by Cisco DNA Center.. Detecting 'Rogue on Wire' APs in Cisco DNA Center requires management of access-layer switches so DNA Center can correlate over-the-air rogue MAC addresses with wired switch port CAM table entries.
Question
A customer recently upgraded the network to Cisco SD-Access. Cisco DNA Center manages the wireless network; all SSIDs are Fabric-enabled. Cisco DNA Center must be able to classify 揜 ogue on Wire" APs. Which action must the customer take?
Options
- AConfigure all access switches to be managed by Cisco DNA Center.
- BAllow SNMPv3 between Cisco DNA Center and access switches.
- CConnect APs to the network using a trunk port with native VLAN.
- DDisable all the DCA channels under RRM on the WLC.
How the community answered
(46 responses)- A83% (38)
- B4% (2)
- C2% (1)
- D11% (5)
Why each option
Detecting 'Rogue on Wire' APs in Cisco DNA Center requires management of access-layer switches so DNA Center can correlate over-the-air rogue MAC addresses with wired switch port CAM table entries.
When DNA Center manages all access switches, it can query their MAC address tables to check whether a detected rogue AP's BSSID appears on a wired port. This wired-side correlation is the exact mechanism that classifies a rogue AP as 'on wire.' Without managed switch inventory, DNA Center has no visibility into wired infrastructure and cannot perform this classification.
SNMPv3 transport security alone is insufficient - the switches must be actively managed and inventoried by DNA Center for wired MAC address table lookups to occur.
Connecting APs on trunk ports with a native VLAN is an AP provisioning configuration and has no role in detecting whether a rogue AP is connected to the wired infrastructure.
Disabling DCA channels under RRM modifies the WLC's dynamic channel assignment behavior and has no relationship to identifying rogue APs on the wired network.
Concept tested: Rogue on Wire detection via DNA Center managed switch access
Source: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-3-7/user_guide/b_cisco_dna_center_ug_2_3_7/m_rogue-and-airewave-director.html
Topics
Community Discussion
No community discussion yet for this question.