300-425 Question 222
Select 4An enterprise organization is implementing 802.1X authentication for their wireless network. They are using Cisco Identity Services Engine (ISE) as the authentication server. The network consists of Cisco Catalyst 9800 Wireless LAN Controllers (WLCs) and lightweight access points. During the configuration process, which of the following steps must be completed to ensure proper 802.1X and AAA integration on this architecture?
- A
Configure the WLC to forward RADIUS authentication requests to the ISE server.
- B
Enable 802.1X on the wireless LANs (WLANs) configured on the WLC.
- C
Configure the access points to act as RADIUS servers for local client authentication.
- D
Specify the ISE server IP address and shared secret on the WLC.
- E
Create client authentication policies on the ISE server to match the SSID.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Implementing 802.1X and AAA with Cisco ISE requires proper integration between the wireless LAN controller, access points, and ISE. The WLC forwards RADIUS requests to ISE, which acts as the authentication server. Enabling 802.1X on the WLAN ensures that clients are authenticated before gaining network access. The ISE server IP and shared secret are necessary for secure communication between the WLC and ISE. Finally, ISE policies must be configured to define the authentication rules, including SSID matching. Access points do not act as RADIUS servers in this architecture, as that functionality is centralized in the WLC.
- A. Correct.
Correct: The WLC must forward RADIUS authentication requests to ISE for 802.1X authentication.
- B. Correct.
Correct: 802.1X must be enabled on the WLANs to enforce client authentication using the RADIUS server.
- C. Incorrect.
Incorrect: Access points do not act as RADIUS servers in this architecture. The WLC handles communication with ISE.
- D. Correct.
Correct: The ISE server's IP address and shared secret must be configured in the WLC to establish secure communication.
- E. Correct.
Correct: Authentication policies must be created on ISE to define the conditions under which clients are authenticated, including SSID matching.