300-430 Question 223
Select 3A company is deploying a wireless network using Cisco Catalyst 9800 Wireless LAN Controllers (WLCs) and Identity Services Engine (ISE) for secure authentication. They require centralized user authentication through 802.1X with role-based access control. Which steps are necessary to implement this solution successfully?
- A
Configure the WLC to use ISE as a RADIUS server for authentication.
- B
Enable WPA3-Personal on the wireless SSID for secure access.
- C
Define an 802.1X policy set in ISE to assign VLANs based on user roles.
- D
Configure the wireless clients to use PEAP (Protected EAP) for authentication.
- E
Set up a local MAC filtering database on the WLC for user authentication.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement 802.1X with AAA on wireless networks using Cisco WLCs and ISE, the WLC must be configured to integrate with ISE as a RADIUS server. ISE should have policy sets defining role-based access controls, such as user role-based VLAN assignments. Wireless clients must also be configured to use an EAP method like PEAP to authenticate securely. WPA3-Personal or local MAC filtering does not apply to this scenario as they do not involve 802.1X or centralized AAA.
- A. Correct.
Correct: The WLC must be configured to use ISE as the RADIUS server to enable centralized 802.1X authentication.
- B. Incorrect.
Incorrect: WPA3-Personal uses a pre-shared key (PSK) and does not support 802.1X authentication. WPA3-Enterprise would be required for 802.1X.
- C. Correct.
Correct: ISE requires the definition of 802.1X policy sets to enforce role-based access control, such as assigning VLANs or applying access policies based on user roles.
- D. Correct.
Correct: PEAP is a common EAP method used for 802.1X authentication, providing secure communication between the client and the authentication server.
- E. Incorrect.
Incorrect: Using a local MAC filtering database on the WLC is not relevant to 802.1X authentication and does not leverage ISE.