You are troubleshooting a WLAN deployment with APs and gateways set up with an 802.1X tunneled SSID. End-users are complaining that they can't connect to the enterprise SSID. Which possible AP…

Question

Options

• ASM_STATE_CONNECTING
• BSM_STATE_SURVIVED
• CSM_STATE_SURVIVING
• DSM_STATE_CONNECTED
• ESM_STATE_REKEYING

• A
  62% (18)
• B
  17% (5)
• D
  7% (2)
• E
  14% (4)

Explanation

In a tunneled SSID deployment, the AP must maintain an active, established tunnel to the gateway for 802.1X authentication to function - because auth traffic is encapsulated and forwarded through that tunnel to the RADIUS server. SM_STATE_CONNECTING (A) means the tunnel is still being built and is not yet operational, so no users can authenticate. SM_STATE_SURVIVING (C) means the AP has lost its connection to the gateway and is operating in survival mode - new 802.1X authentications fail because the tunnel required to forward credentials to RADIUS is down.

The distractors are wrong for these reasons:

• B (SM_STATE_SURVIVED) indicates the AP successfully reconnected to the gateway after a survival period and is back to normal operation - users can connect.
• D (SM_STATE_CONNECTED) is the fully operational tunnel state - this is exactly where you want to be, and users can authenticate fine.
• E (SM_STATE_REKEYING) is a brief background process where tunnel security keys are refreshed; the tunnel stays live throughout and does not block user connections.

Memory tip: Focus on states that spell "not ready yet" - Connecting = "Can't connect yet" (tunnel building), and Surviving = "Starved of gateway" (tunnel broken). Any state where the tunnel is fully up (Connected, Survived, Rekeying) means users are fine.

No community discussion yet for this question.