300-425 Question 26
Single answerAn organization is deploying a Cisco FlexConnect environment with multiple branch locations. Each branch location has its own VLANs configured on the local switches. The organization wants to enforce specific access control policies for local traffic at the branch locations without sending all traffic to the centralized controller. Which feature should be used to achieve this, and how should it be implemented?
- A
Configure VLAN-based central switching with centralized ACLs on the WLC.
- B
Enable VLAN-based central switching with local Flex ACLs on the access points.
- C
Use FlexConnect local switching and configure ACLs directly on the local switches.
- D
Implement FlexConnect local switching with Flex ACLs applied on the access points.
Show answer and explanation
Correct answer: D
Explanation
FlexConnect local switching is the appropriate feature for scenarios where traffic needs to be switched locally at the branch level instead of being tunneled back to the central controller. By applying Flex ACLs on the access points, the organization can enforce consistent access control policies at the branch level without relying on centralized processing, reducing latency and conserving WAN bandwidth.
- A. Incorrect.
This option is incorrect because VLAN-based central switching sends all traffic to the central controller, which does not align with the requirement to enforce policies locally at the branch sites.
- B. Incorrect.
This option is incorrect because VLAN-based central switching is still centralized, and local Flex ACLs cannot be applied in this mode. The organization needs traffic processing to occur locally.
- C. Incorrect.
This option is incorrect because ACLs configured on local switches are not managed by the wireless infrastructure, making it harder to ensure consistent policy enforcement across wireless clients.
- D. Correct.
This option is correct because FlexConnect local switching allows branch APs to locally switch traffic within their VLANs, and Flex ACLs enforce access control policies directly on the access points, meeting the requirement for local policy enforcement.