300-425 Question 310
Select 3A network administrator is implementing centralized authentication for device access in a Cisco wireless network. They are configuring a WLC to use RADIUS for authentication and authorization of administrators. Which of the following steps must be completed to properly configure device access controls using RADIUS?
- A
Configure the RADIUS server IP address and shared secret on the WLC
- B
Enable TACACS+ as the primary authentication method for the WLC
- C
Define the RADIUS server group and assign it to the WLC management interface
- D
Configure administrator roles and privileges on the RADIUS server
- E
Enable local authentication fallback on the WLC in case the RADIUS server becomes unreachable
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement device access controls using RADIUS on a Cisco WLC, you must configure the RADIUS server's IP address and shared secret, define the RADIUS server group, and assign it to the WLC management interface. Additionally, administrator roles and privileges should be configured on the RADIUS server to control what authenticated users can do. TACACS+ and local authentication fallback are not relevant to the specific RADIUS configuration described in the scenario.
- A. Correct.
Correct: Configuring the RADIUS server IP address and shared secret on the WLC is essential for enabling communication between the WLC and the RADIUS server.
- B. Incorrect.
Incorrect: TACACS+ is not being used in this scenario. The question specifies RADIUS for authentication and authorization.
- C. Correct.
Correct: Defining the RADIUS server group and assigning it to the WLC management interface ensures that the WLC knows which RADIUS server to contact for authentication requests.
- D. Correct.
Correct: Administrator roles and privileges must be configured on the RADIUS server to define what actions authenticated users can perform.
- E. Incorrect.
Incorrect: While enabling local authentication fallback is a best practice for high availability, it is not a mandatory step for setting up RADIUS-based authentication.