300-425 Question 221
Select 3An organization has deployed Cisco Identity Services Engine (ISE) to enforce 802.1X authentication for its wireless network. The wireless LAN controller (WLC) is configured to use RADIUS for AAA services. During testing, users are unable to authenticate to the network. Upon inspecting the logs, you notice that the WLC is not communicating with the RADIUS server. Which of the following actions should be taken to resolve this issue?
- A
Verify that the shared secret between the WLC and the RADIUS server matches.
- B
Ensure the WLC is configured with the correct IP address of the RADIUS server.
- C
Enable dynamic VLAN assignment on the WLC for 802.1X.
- D
Check that the correct RADIUS ports (1812 and 1813) are open between the WLC and the RADIUS server.
- E
Ensure the RADIUS server certificate is trusted by the client devices.
Show answer and explanation
Correct answers: A, B, D
Explanation
For successful 802.1X authentication, the WLC and RADIUS server must be able to communicate. This requires a matching shared secret, the correct IP configuration, and open RADIUS ports (1812 and 1813) between the devices. Dynamic VLAN assignment and client trust in server certificates are unrelated to the initial communication issue observed in this scenario.
- A. Correct.
The shared secret between the WLC and RADIUS server must match for successful communication. A mismatch will cause authentication failures.
- B. Correct.
The WLC must be configured with the correct IP address of the RADIUS server, as an incorrect address will prevent communication.
- C. Incorrect.
Dynamic VLAN assignment is not required to establish communication between the WLC and RADIUS server. It is used for assigning VLANs to clients post-authentication.
- D. Correct.
The RADIUS communication occurs over ports 1812 (authentication) and 1813 (accounting). If these ports are blocked, the WLC cannot communicate with the RADIUS server.
- E. Incorrect.
While the RADIUS server certificate is important for client trust in EAP-TLS authentication, it does not affect the WLC's ability to communicate with the RADIUS server.