300-425 Question 29
Select 3An enterprise is deploying a distributed wireless network using Cisco FlexConnect. The network administrator wants to ensure that traffic from specific VLANs is centrally switched, while applying localized security policies using Flex ACLs for other VLANs. Which configuration should be applied to achieve this?
- A
Configure the WLAN VLAN mapping for central switching and define the VLANs that require traffic to be tunneled to the controller.
- B
Enable local switching on the WLAN for VLANs that need Flex ACLs and define the ACLs on the APs.
- C
Disable local authentication on the WLAN to use Flex ACLs with central switching.
- D
Configure the APs in FlexConnect mode and apply Flex ACLs at the AP level for locally switched traffic.
- E
Enable client VLAN mapping override to dynamically determine whether traffic is centrally or locally switched.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement both VLAN-based central switching and localized security policies using Flex ACLs, the WLAN configuration should specify VLANs for central switching, while enabling local switching for other traffic. When APs are in FlexConnect mode, Flex ACLs can enforce policies for locally switched VLANs. These configurations allow for a hybrid approach where traffic is either centrally tunneled or locally processed based on specific requirements.
- A. Correct.
Correct: Central switching requires the WLAN VLAN mapping to be configured for the VLANs that should tunnel traffic to the controller. This ensures that these VLANs are centrally switched.
- B. Correct.
Correct: Enabling local switching allows traffic to be processed locally at the AP, and Flex ACLs can be defined on the APs to enforce localized security policies.
- C. Incorrect.
Incorrect: Local authentication is unrelated to whether Flex ACLs can be applied to locally or centrally switched traffic.
- D. Correct.
Correct: When APs are in FlexConnect mode, Flex ACLs can be applied at the AP level for VLANs that are locally switched, providing localized security enforcement.
- E. Incorrect.
Incorrect: Client VLAN mapping override is not required for this scenario, as the switching behavior is determined by WLAN configuration rather than dynamic mapping.