Cisco Certified Internetwork Expert (CCIE) Wireless — Practice Set 1

Question 1

On a Cisco Catalyst 9800 WLC, an engineer configures a Policy Tag, a Site Tag, and an RF Tag for a set of APs. Which statement accurately describes how these three tags interact to define the complete operational profile of an AP?

Accepted Answer

Catalyst 9800 uses a tag-based architecture replacing the legacy AP group model. The Policy Tag maps WLAN Profiles to Policy Profiles — each WLAN/Policy Profile pair defines how client traffic is treated (VLAN assignment, QoS DSCP, central vs local switching, ACLs, AAA). The Site Tag determines the site context: when set to 'local' site, the AP operates in FlexConnect or Local mode with a Flex Profile defining per-VLAN switching; when set to 'remote' site, the AP uses centralized switching. The RF Tag applies an RF Profile to the AP's radios, controlling minimum/maximum data rates, channel width, TPC, RRM participation, and CleanAir. These three tags can be assigned independently, giving granular control. Option B incorrectly assigns radio-band meanings to the tags. Options C and D are fabricated.

Question 2

A Catalyst 9800 AP is joining the WLC for the first time via CAPWAP. The AP has no DHCP option 43 or DNS pre-configuration pointing to the WLC. In what order does the AP attempt CAPWAP discovery, and what is the role of the 'mobility announce' mechanism?

Accepted Answer

Cisco CAPWAP AP discovery follows this priority sequence: (1) previously joined WLC IP (saved in AP flash after first successful join); (2) DHCP option 43 — the WLC IP is encoded as a hex string in TLV format within the vendor-specific option (type 0xf1); (3) DNS resolution of 'cisco-capwap-controller.localdomain' (the AP appends the DHCP-assigned domain); (4) subnet-directed broadcast on the management subnet; (5) over-the-air provisioning (OTAP, typically disabled). Mobility Announce is a CAPWAP control message sent post-join by the WLC to inform peer WLCs in the mobility group about the newly joined AP, enabling mobility tracking — it is not part of the discovery phase. Option C is wrong: DHCP option 43 for CAPWAP uses hex-encoded IP, not decimal string. Option D fabricates a 'Load Offer' mechanism.

Question 3

In CAPWAP split-MAC architecture, tasks are divided between the AP and the WLC. An engineer asks which 802.11 functions are handled locally by the AP (real-time functions) versus those handled by the WLC (management functions). Which list correctly categorizes these tasks?

Accepted Answer

CAPWAP split-MAC divides 802.11 MAC functions based on timing criticality. Real-time functions requiring sub-millisecond response are handled by the AP: beacon transmission, probe response generation, PS-Poll response (power-save buffer release), ACK generation (PHY-layer acknowledgment), RTS/CTS exchange, and fragmentation/defragmentation. Non-time-critical management functions are handled by the WLC: 802.11 authentication frame processing, association/reassociation decision, 802.1X/EAP session termination, 4-way handshake (EAPOL key exchange), QoS DSCP classification, and mobility tunneling. Option B reverses the split incorrectly. Option C describes a fully centralized (CRPI-like) model, not CAPWAP. Option D is incorrect; split-MAC applies in all AP modes including centralized.

Question 4

A network engineer enables DTLS (Datagram Transport Layer Security) encryption on the CAPWAP data channel of a Cisco Catalyst 9800 deployment. What is the security benefit, and what is the performance trade-off?

Accepted Answer

By default on Cisco CAPWAP implementations, the control channel is DTLS-encrypted (mandatory), but the data channel is unencrypted (for performance). When DTLS is enabled on the CAPWAP data channel, all client frames tunneled between AP and WLC are DTLS-encrypted, protecting against a malicious insider tapping the wired network. The cost is encryption overhead: additional CPU cycles on both AP and WLC, plus ~15–30 bytes of DTLS record header added to each frame, increasing packet size and reducing effective throughput, particularly noticeable at high frame rates. Option B is wrong — DTLS data option specifically protects client payload, not just control. Option C is incorrect; DTLS data encryption is optional and disabled by default on many platforms. Option D fabricates a mode-switching behavior that does not exist.

Question 5

An enterprise wireless engineer configures WMM (Wi-Fi Multimedia) on a Catalyst 9800 WLAN. A VoIP application maps its DSCP EF (46) traffic to WMM Access Category AC_VO. What are the AIFS and CWmin/CWmax values for AC_VO compared to AC_BE (Best Effort), and why do these values give voice traffic lower latency access to the medium?

Accepted Answer

WMM (Wi-Fi Multimedia, based on IEEE 802.11e EDCA) uses Enhanced Distributed Channel Access to prioritize traffic by assigning different EDCA parameters per Access Category. AC_VO (Voice) parameters: AIFS=2, CWmin=3 (2^2-1), CWmax=7 (2^3-1). AC_BE (Best Effort) parameters: AIFS=3, CWmin=15 (2^4-1), CWmax=1023 (2^10-1). The AIFS value determines how many slot times a STA must wait after the medium is idle before beginning its random backoff — smaller AIFS means AC_VO starts its backoff sooner. The CW (Contention Window) determines the range [0, CWmin] from which a random backoff count is chosen — AC_VO's tiny CWmin/CWmax means shorter expected backoffs and statistically fewer collisions compared to AC_BE. Options B, C, and D describe mechanisms that do not exist in WMM/EDCA.

Question 6

On a Cisco Catalyst 9800, an engineer needs to capture wireless client frames for troubleshooting an 802.1X authentication failure. Which embedded packet capture command sequence initiates a wireless packet capture on the WLC for a specific client MAC address?

Accepted Answer

Catalyst 9800 (EWLC) supports embedded packet capture via the 'monitor capture' CLI. For wireless captures, the engineer specifies the wireless interface context using the 'inner-mac' parameter to filter by client MAC address, combined with a display-filter for Wireshark-compatible filtering. The full syntax on C9800 for wireless client capture is: 'monitor capture MYCAP interface wireless display-filter "wlan.sa == aa:bb:cc:dd:ee:ff" inner-mac aa:bb:cc:dd:ee:ff' followed by 'monitor capture MYCAP start'. The capture can then be exported via 'monitor capture MYCAP export flash:capture.pcap'. Option A uses a wired interface syntax. Option B captures all APs but lacks client MAC filtering. Option D describes a debug command, not a packet capture; 'monitor capture' is fully supported on C9800.

Question 7

A Cisco Catalyst 9800 WLC is configured with multicast-enabled WLANs. The engineer must decide between CAPWAP multicast mode and CAPWAP unicast mode for BUM (Broadcast, Unknown Unicast, Multicast) traffic delivery to APs. What are the key operational differences?

Accepted Answer

CAPWAP multicast mode (also called multicast-multicast) requires multicast routing to be enabled between the WLC and all APs. The WLC sends one CAPWAP-wrapped BUM frame to a configured multicast group address; all APs join this group via IGMP and receive a single copy, minimizing WLC CPU and bandwidth usage. CAPWAP unicast mode (multicast-unicast) requires no multicast infrastructure — the WLC replicates and sends a separate unicast CAPWAP copy to each AP, which is simple to deploy but does not scale well (N APs = N copies of every BUM frame sent by WLC). IGMP snooping on intermediate switches is actually relevant for multicast mode (ensuring packets reach subscribing APs), not disabled for it. Options B, C, and D contain factual errors.

Question 8

On a Cisco Catalyst 9800 WLAN, an engineer configures a Layer 3 web authentication policy with a pre-auth ACL. A client associates to the WLAN and receives a DHCP address. Before authenticating via the web portal, what traffic does the pre-auth ACL permit, and what happens to traffic not matching the ACL?

Accepted Answer

In Catalyst 9800 Layer 3 web authentication, the pre-authentication ACL is applied to the client's VLAN/SVI immediately after DHCP. The ACL's purpose is to permit only the minimum traffic needed to reach the web portal: DNS resolution (UDP 53) for portal hostname, DHCP renewal (UDP 67/68), and HTTPS/HTTP to the WLC's virtual IP address (commonly 192.0.2.1) and optionally the portal server. All other traffic hits an implicit deny and is dropped. When the client sends an HTTP/HTTPS request to any external site, the WLC intercepts it and sends a 302 redirect to the captive portal URL. After the user authenticates, a post-auth ACL is applied granting broader network access. Option B incorrectly states that only HTTP is redirected and HTTPS passes freely. Option C is wrong about centralized mode support. Option D invents an IPv6-only restriction.

Question 9

A Cisco Catalyst 9800 FlexConnect WLAN is configured with split tunneling. A specific subnet (10.10.50.0/24 — local servers) must be switched locally at the branch AP, while all other client traffic is centrally switched to the headquarters WLC. Which configuration object and parameter enables this per-subnet split tunneling?

Accepted Answer

Catalyst 9800 FlexConnect split tunneling (introduced in IOS-XE 16.12) is configured using a split-tunnel ACL within the Flex Profile or Policy Profile. The engineer creates a named ACL with permit entries for subnets that should be locally switched (e.g., permit 10.10.50.0 0.0.0.255 any). Client traffic matching a permit ACE is forwarded by the AP directly to the local branch LAN without CAPWAP encapsulation. Traffic matching the implicit deny (all other destinations) is CAPWAP-encapsulated and centrally switched through the WLC to the headquarters network. This is different from per-VLAN switching (option C), which switches entire VLANs rather than specific subnets within the same VLAN. Option B invents an AP static-route mechanism. Option D adds an unnecessary ISE dependency.

Question 10

On a Cisco Catalyst 9800 WLAN, an engineer enables P2P (peer-to-peer) client isolation in 'drop' mode. A wireless client on the WLAN tries to communicate with another client on the same SSID connected to the same AP. What happens to this traffic?

Accepted Answer

Catalyst 9800 P2P (peer-to-peer) client isolation prevents direct wireless-to-wireless communication between clients on the same SSID. In 'drop' mode, the AP enforces isolation at the wireless MAC layer: when a frame is received from Client A destined for Client B (both on the same WLAN/AP), the AP discards the frame immediately without forwarding it to the wired network or to the WLC. This is the most efficient isolation method as it stops the frame at the earliest point. In 'forward-upstream' mode, the AP forwards the frame to the WLC via CAPWAP, and the WLC then drops it after inspecting the destination — this mode is used when the WLC needs visibility into inter-client traffic for logging or IDS purposes. Options B, C, and D mischaracterize the drop mode behavior.

Question 11

An engineer is configuring 802.11r Fast BSS Transition (FT) on a Cisco Catalyst 9800 WLAN. The design specifies FT over-the-DS (Distribution System) rather than FT over-the-air. What is the key operational difference between these two FT modes, and which scenario favors FT over-the-DS?

Accepted Answer

802.11r (Fast BSS Transition) supports two modes. Over-the-air FT: the client sends FT Authentication Request directly to the target AP's BSSID over the 802.11 medium (while still associated with the current AP), the target AP responds, and the client then performs the reassociation to complete the transition — very fast since there is no wired relay. Over-the-DS FT: the client sends FT Authentication Request to the current AP (still via 802.11), the current AP encapsulates and relays it through the wired distribution system (CAPWAP/mobility tunnel) to the target AP, which responds back via the wired path. Over-the-DS is useful when the client is not yet within radio range of the target AP or when an existing CAPWAP/mobility infrastructure is preferred for key distribution. Option B is wrong — FT mode selection is not band-specific. Option C invents a separate FT RADIUS server. Option D is wrong — the mode is configured on the WLC, not auto-selected by the client.

Question 12

In an 802.11r deployment on Catalyst 9800, what is the PMK key hierarchy used for Fast BSS Transition, and what are the roles of R0KH and R1KH?

Accepted Answer

IEEE 802.11r defines a three-level FT key hierarchy. The PMK (from 802.1X EAP or PSK) is the root. PMK-R0 is derived by the client and the R0 Key Holder (R0KH) — in Cisco Catalyst 9800 deployments, the R0KH is the WLC that anchors the client's session; this derivation uses the client's PMK, the R0KH identifier, and the client's MAC address. PMK-R1 is derived from PMK-R0 by the R0KH and distributed (via IAPP or mobility tunnel) to the R1KH — which is each individual AP that may serve as the target for roaming. The PTK for each new AP association is then derived by the client and the target AP from PMK-R1 during the FT 4-way handshake, avoiding full EAP re-authentication. Option B is wrong — FT does derive new keys via hierarchical KDF. Option C reverses the R0KH/R1KH roles. Option D incorrectly eliminates WLC involvement.

Question 13

An 802.11k Neighbor Report is enabled on a Cisco Catalyst 9800 WLAN. A client device sends a Neighbor Report Request frame to its current AP. What information is returned in the Neighbor Report Response, and how does the client use this information?

Accepted Answer

IEEE 802.11k Neighbor Report enables client-assisted roaming by giving the client advance knowledge of neighboring APs. The client sends a Radio Measurement Request (Neighbor Report Request) to its current AP. The AP responds with a Neighbor Report containing Neighbor Report Elements, each including: BSSID, SSID (optionally), operating class (which maps to regulatory domain and channel), channel number, PHY type, and AP reachability information. The client uses this list to perform targeted channel scanning instead of a full active/passive scan of all channels, dramatically reducing the time needed to discover and select a roaming target. This information is also used as input to 802.11r FT candidate lists and 802.11v BSS Transition Management. Options B, C, and D mischaracterize the protocol operation.

Question 14

On a Cisco Catalyst 9800 WLAN with 802.11v BSS Transition Management enabled, the WLC sends a BSS Transition Management Request to a client with the 'Disassociation Imminent' bit set. The request includes a candidate AP list. What behavior is mandated by the 802.11v specification, and how might a client respond?

Accepted Answer

IEEE 802.11v BSS Transition Management allows the network to suggest or mandate AP roaming. When the AP (via WLC) sends a BTM Request with the Disassociation Imminent bit set, it includes a Disassociation Timer field indicating how many beacon intervals remain before the AP will disassociate the client. The client should respond with a BTM Response frame with status 'Accept' (roaming to a provided candidate) or 'Reject' with a reject reason code. IEEE 802.11v does not immediately force disconnection — the disassociation timer gives the client time to transition gracefully. If the client does not roam within the timer period, the AP sends a Disassociation frame. Note that BTM Requests with PMF enabled are protected management frames, but PMF is not strictly required to use 802.11v on WPA2 networks (PMF capable is sufficient). Options B, C, and D contain inaccuracies.

Question 15

A Cisco Catalyst 9800 WLC is deployed in a centralized mode. An engineer needs to verify whether a specific wireless client (MAC: aa:bb:cc:dd:ee:ff) has completed DHCP successfully. Which combination of show commands provides the client's current association state AND DHCP-assigned IP address?

Accepted Answer

On Catalyst 9800, 'show wireless client summary' provides a quick overview of all associated clients including their state (associated, authenticating, run state). 'show wireless client detail mac-address <mac>' provides comprehensive client information: IP address (DHCP-assigned), VLAN, gateway, SSID, AP name, association time, roam count, QoS policy, and authentication details. These two commands together confirm both 802.11 association state and DHCP success. Option B uses IOS DHCP server commands (applicable if C9800 is acting as DHCP server) and 'show dot11 associations' which is an older IOS-based AP command, not C9800 syntax. Option C uses incorrect command syntax ('show wlan client-detail' is not a valid C9800 command). Option D is wrong — debug is for real-time capture, and show commands do display DHCP state.

Question 16

An engineer uses Catalyst Center wireless troubleshooting and finds that a client's onboarding health score shows 'Association Failed' for multiple clients on the same AP. The AP radio is functioning and other clients on neighboring APs are healthy. Which step in the Catalyst Center client 360 workflow helps narrow the root cause?

Accepted Answer

In Catalyst Center wireless assurance, multiple association failures on a single AP while neighboring APs are healthy point to an AP-specific issue. The AP Device 360 view shows radio health, channel utilization, noise, and interference levels — high channel utilization can cause admission control to reject new associations. Additionally, deploying a Sensor Test Suite from a Cisco 1800S AP sensor tests the full onboarding path (SSID discovery, association, authentication, DHCP, DNS, ping) from a known-good device, confirming whether the SSID configuration itself is faulty or if the issue is device-specific. Using both diagnostic tools together (Device 360 for AP health metrics and Sensor Suite for protocol-level validation) provides the most efficient root-cause isolation. Option D is incorrect to assume RADIUS as the only cause — association precedes authentication, so RADIUS is not involved in an association failure.

Question 17

An enterprise deploys a Cisco Catalyst 9800 WLAN with WPA3 SAE (Simultaneous Authentication of Equals). An AP receives an SAE Commit frame from a client. Which security property does the AP enforce during the SAE Commit-Confirm exchange to prevent timing side-channel attacks?

Accepted Answer

SAE's Dragonfly key exchange uses a password element (PWE) derivation process (originally hunting-and-pecking, now superseded by the hash-to-element method per RFC 9380 and IEEE 802.11-2020 corrigendum). A known vulnerability of the original hunting-and-pecking algorithm was timing side-channels — the number of loop iterations varied based on the password and MAC addresses, leaking information. RFC 8492 and the 802.11 standard mandate constant-time implementations where the PWE derivation takes the same amount of time regardless of input values, preventing timing-based side-channel attacks (Dragonblood vulnerability, CVE-2019-9494). Cisco implemented the hash-to-element method as the fix. Options B, C, and D describe mechanisms that do not correspond to the actual SAE anti-timing mitigations.

Question 18

A Cisco Catalyst 9800 WLAN is configured for WPA3-Enterprise. The security team wants to enforce mutual authentication where both the client and the RADIUS server verify each other's certificates. Which EAP method and certificate requirement satisfies this?

Accepted Answer

EAP-TLS (RFC 5216) is the only standard EAP method that provides full mutual certificate authentication: the TLS handshake requires both parties to present and verify X.509 certificates. The RADIUS server presents its certificate (client validates against its trusted root CA), and the client presents its certificate (RADIUS validates against its trusted root CA or intermediate CA). This satisfies both WPA3-Enterprise requirements and the security team's mutual authentication mandate. EAP-PEAP/MSCHAPv2 (option A) only authenticates the server via certificate — the client uses a username/password. EAP-TTLS/PAP (option C) also lacks true client certificate authentication. EAP-FAST (option D) uses PACs, which are not X.509 certificates.

Question 19

On a Cisco Catalyst 9800, a WLAN is configured with WPA2 + 802.1X + OKC (Opportunistic Key Caching). A client roams from AP1 to AP2 (both on the same WLC). The client includes a PMKID in its reassociation request to AP2. The WLC finds a matching PMKSA. Which frames are exchanged to complete the roaming security handshake, and which exchange is skipped?

Accepted Answer

OKC (Opportunistic Key Caching), also known as Proactive Key Caching (PKC) or PMKID-based fast roaming, allows a client to include the PMKID (derived from the existing PMK and the target AP's BSSID) in its Reassociation Request. If the WLC has a valid PMKSA for this PMKID, the full EAP authentication exchange with the RADIUS server is bypassed entirely — no EAP-Request/Response or RADIUS Access-Challenge/Accept messages are needed. The WLC retrieves the cached PMK and the client and AP2 proceed directly to the 4-way EAPOL handshake to derive a fresh PTK (Pairwise Transient Key) and install new encryption keys. The 4-way handshake is NOT skipped (option B is wrong) because a new PTK must be generated for the new AP. Options C and D describe non-existent mechanisms.

Question 20

A Catalyst 9800 deployment uses multiple AP join profiles. An AP joins and matches the default AP join profile. A network engineer wants to ensure a specific group of APs (identified by their AP ethernet MAC prefix) automatically receives a custom AP join profile with a specific NTP server and syslog server configuration. Which mechanism on C9800 enables automatic AP join profile assignment based on AP MAC attributes?

Accepted Answer

Catalyst 9800 supports AP filter-based tag assignment under 'wireless tag policy'. AP filters use regex rules to match AP names, AP locations, or AP MAC address patterns (OUI prefix or full MAC). When an AP joins and its attributes match a filter rule, the WLC automatically assigns the Policy Tag, Site Tag, and RF Tag specified in the filter — including the AP join profile reference within the site tag. This eliminates manual per-AP configuration in large deployments. Option B incorrectly requires RADIUS for join profile assignment. Option C is wrong — automated assignment via filters is a core C9800 feature. Option D confuses Catalyst Center's Day-N provisioning with join-time profile assignment.

Question 21

A Cisco Catalyst 9800 EWLC is configured with Radioactive Tracing (RA tracing) for client MAC aa:bb:cc:dd:ee:ff. After triggering a client connection attempt, the engineer collects the trace. The trace shows the EAP exchange completing successfully and the 4-way handshake completing, but the client shows 'IP Learn Incomplete'. What does this state indicate, and which protocol is likely failing?

Accepted Answer

On Catalyst 9800, the client state machine progresses through: Idle → Associating → Authenticating → Associated (802.11 complete) → 8021X_REQD (if EAP) → Authenticated → IP Learn → Run. 'IP Learn Incomplete' (or the client stuck in 'IP Learn' state) means 802.11 association and 802.1X authentication completed but the WLC has not learned the client's IP address. The WLC learns client IPs via: DHCP snooping (intercepting DHCP ACK), ARP snooping (watching ARP reply/request), or gratuitous ARP. If DHCP is failing — server unreachable, helper address wrong, pool exhausted, or VLAN misconfigured — the client will never get an IP and the WLC state stays at IP Learn. The Radioactive Trace will show DHCP messages (or lack thereof) confirming this. Option B is wrong — 802.1X completed. Option C is possible but narrowly scoped; option A correctly identifies the general cause. Option D is wrong — this state does not self-resolve without a valid IP assignment.

Question 22

A Cisco Catalyst 9800 WLC manages 150 APs across a campus. The network team decides to migrate from central DHCP (WLC acts as DHCP proxy) to local DHCP servers at each building. In the WLAN Policy Profile, which setting must the engineer change to ensure client DHCP requests are forwarded to the local DHCP server rather than being proxied by the WLC?

Accepted Answer

On Catalyst 9800, the Policy Profile under a WLAN controls DHCP behavior. By default, the WLC can act as a DHCP proxy (intercepting client DISCOVER/REQUEST and forwarding on behalf of the client). To use external DHCP servers, the engineer sets the DHCP server to 'External' (or disables proxy mode) in the Policy Profile, then ensures the client-facing SVI or VLAN interface on the access/distribution switch has an 'ip helper-address' configured pointing to the local DHCP server. The 'DHCP Required' flag controls whether clients must obtain an IP before being moved to the Run state — disabling it allows clients to self-configure (e.g., APIPA), which is a separate consideration. Option B's 'Native VLAN Override' is unrelated to DHCP proxy behavior. Option C invents a 'local-only' setting. Option D is incorrect; DHCP proxy can be managed at the WLAN/Policy Profile level.

Question 23

An enterprise wireless deployment uses Cisco ISE as the RADIUS server. ISE returns a RADIUS Access-Accept with the Cisco VSA 'Cisco-AVpair: url-redirect=https://ise.corp.com/portal' and 'Cisco-AVpair: url-redirect-acl=REDIRECT_ACL'. The Catalyst 9800 WLC receives this response. What action does the WLC take, and what is the purpose of the 'url-redirect-acl'?

Accepted Answer

Cisco ISE dynamic authorization via RADIUS VSAs (CiscoAVpair: url-redirect and url-redirect-acl) is a core feature of the Cisco centralized policy architecture. When the WLC receives a url-redirect along with url-redirect-acl in the RADIUS Access-Accept, it applies a per-client redirect policy. The url-redirect-acl is a named ACL configured locally on the WLC (or referenced from ISE-downloaded policy). ACEs with 'permit' action identify traffic that must be intercepted and HTTP-redirected to the portal URL (typically any HTTP/HTTPS to external destinations). ACEs with 'deny' (or 'redirect' vs 'bypass' terminology depending on platform version) identify traffic that should be allowed to pass without redirect — critical for DNS resolution, DHCP renewal, and direct access to the portal server's IP. This enables guest onboarding, posture checking (ISE), and CoA flows. Options B, C, and D are incorrect.

Question 24

On a Cisco Catalyst 9800 WLC, an engineer configures a WLAN using the Flex Profile for FlexConnect local switching. The Flex Profile specifies VLAN 100 for the employee SSID. The AP at the remote site does not have a trunk port configured to carry VLAN 100 to the access switch. What is the result when a client associates to the employee SSID?

Accepted Answer

In FlexConnect local switching, the AP tags client frames with the configured VLAN (VLAN 100) and forwards them out its wired Ethernet port. If the switch port connecting the AP is not trunked to carry VLAN 100, the tagged frames will be dropped by the switch (or the AP cannot properly egress them). The 802.11 association itself succeeds — the AP will accept the client and the WLC will complete authentication — but subsequent DHCP discovery over VLAN 100 will fail because the frames cannot traverse the switch. The client will time out waiting for a DHCP response and remain in an 'IP Learn Incomplete' state. The AP does not automatically fall back to central switching per-VLAN in standard FlexConnect (option C); fallback requires explicit central switching configuration. Options B and D describe behaviors that do not occur.

Question 25

A CCIE Wireless candidate must design a guest WLAN on Cisco Catalyst 9800 where guest clients are anchored to a DMZ WLC for security. The foreign WLC (at branch) and anchor WLC (at DMZ) must be configured. Which configuration is required on both WLCs to enable guest anchoring, and how is client traffic handled between foreign and anchor?

Accepted Answer

Cisco Catalyst 9800 supports guest anchoring via the mobility group and EoIP (Ethernet over IP) mobility tunnel architecture. Configuration requirements: both WLCs must be configured as mobility peers (same mobility group or explicit peer configuration with each other's management IP and mobility MAC). On the foreign WLC, the guest WLAN is configured with the anchor WLC's IP as a mobility anchor. On the anchor WLC, the same guest WLAN (matching SSID/WLAN ID) is configured with the local WLC as the anchor. Traffic flow: client associates to AP, CAPWAP to foreign WLC; foreign WLC establishes EoIP mobility tunnel to anchor WLC; all client data traffic traverses the EoIP tunnel to the anchor, where the client is placed on the DMZ VLAN. The anchor handles DHCP and internet breakout from the DMZ. Option B is wrong — IPsec is not required. Option C invents 'anchor mode only' and 'foreign mode only' settings. Option D is incorrect — ISE is not required for direct WLC mobility.

350-401 ENCOR — Cisco Certified Internetwork Expert (CCIE) Wireless