An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication. The administrator tests the 802.1X authentication for the endpoint and…

Question

Options

• AConfigure the switchport access vlan 310 command on the switch port
• BEnsure that the security group is not preventing the endpoint from being in VLAN 310
• CAdd VLAN 310 in the common tasks of the authorization profile
• DEnsure that the endpoint is using The correct policy set

• A
  4% (2)
• B
  6% (3)
• C
  76% (38)
• D
  14% (7)

Explanation

In Cisco ISE, VLAN assignment is delivered dynamically to the switch via RADIUS attributes as part of the authorization result. The authorization profile in ISE must include the VLAN ID under the 'Common Tasks' section, which automatically populates the correct RADIUS Tunnel attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) that instruct the switch to place the endpoint into the specified VLAN. Option A (static switchport command) would hardcode the VLAN on the port and override dynamic assignment. Option B (security group) refers to TrustSec SGTs, which are a separate access control mechanism unrelated to VLAN assignment. Option D (policy set) could be a factor, but the specific missing element described is the VLAN configuration within the authorization profile itself.

No community discussion yet for this question.