300-430 Question 320
Select 2You are configuring a Cisco Wireless LAN Controller (WLC) to restrict access to specific management interfaces by applying control plane ACLs. Which of the following actions should be taken to ensure that only devices from a specific subnet can manage the WLC via SSH, while preventing other subnets from accessing the SSH service?
- A
Create an access control list (ACL) that permits the specific subnet and apply it to the management interface.
- B
Use the WLC's CPU ACL feature to define and apply an ACL for SSH traffic.
- C
Configure a Layer 2 ACL to block SSH traffic from all other subnets.
- D
Apply the control plane ACL globally to ensure it restricts SSH access across all interfaces.
- E
Enable stateful inspection on the WLC to dynamically manage SSH access.
Show answer and explanation
Correct answers: A, B
Explanation
Control plane ACLs are critical for securing management access to a Cisco WLC. To allow SSH access only from a specific subnet, you need to create an ACL that permits traffic from that subnet and apply it using the CPU ACL feature. This ensures that only authorized devices can manage the WLC, while unauthorized subnets are blocked. Layer 2 ACLs, global application, or stateful inspection are not appropriate methods for addressing this requirement.
- A. Correct.
Correct: Control plane ACLs are typically applied at the management interface or CPU level, and creating an ACL to permit traffic from a specific subnet is the first step.
- B. Correct.
Correct: The CPU ACL feature on Cisco WLCs allows you to enforce control plane traffic restrictions, including SSH, which is necessary for securing management access.
- C. Incorrect.
Incorrect: Layer 2 ACLs operate on MAC addresses and are not appropriate for restricting control plane traffic such as SSH, which operates at Layer 3.
- D. Incorrect.
Incorrect: Control plane ACLs should be applied to specific interfaces or traffic types, not globally, to avoid unintended disruptions to other services.
- E. Incorrect.
Incorrect: Stateful inspection is not relevant to control plane ACLs; it is used for monitoring and filtering traffic at the data plane level.