300-430 Question 322
Select 3You are configuring a Cisco Wireless LAN Controller (WLC) to enhance network security by restricting specific management traffic. You decide to implement control plane ACLs. Which of the following steps must be taken to correctly implement control plane ACLs on the WLC?
- A
Define an ACL under the Security > Access Control List section on the WLC.
- B
Specify the control plane ACL in the CPU ACL settings under the WLC's Advanced Configuration.
- C
Ensure that the ACL rules include both permit and deny statements based on the required traffic.
- D
Apply the ACL directly to the WLAN SSID configuration under the WLANs tab.
- E
Verify the ACL by reviewing the WLC's packet capture logs for traffic filtering behavior.
Show answer and explanation
Correct answers: A, B, C
Explanation
Control plane ACLs on a Cisco WLC are used to manage traffic destined for the WLC's CPU, such as management protocols or control traffic. To implement these ACLs, you must first define them in the ACL settings, specify them in the CPU ACL configuration, and ensure the ACL rules are properly written with permit and deny statements. Applying the ACL to WLAN SSIDs or relying solely on packet captures are not steps in this process, as control plane ACLs specifically target traffic to the controller's control plane rather than user data traffic.
- A. Correct.
Defining an ACL under the Security > Access Control List section on the WLC is the first step in creating a control plane ACL, as this is where the ACL rules are configured.
- B. Correct.
Specifying the ACL in the CPU ACL settings is necessary to apply the control plane ACL to manage traffic directed to the WLC's control plane.
- C. Correct.
Including both permit and deny statements ensures the correct traffic is allowed or blocked as per the network policy, which is a crucial part of ACL configuration.
- D. Incorrect.
Applying the ACL directly to the WLAN SSID configuration is not relevant to control plane ACLs, as those are specifically for the WLC's management and control traffic, not user or data traffic.
- E. Incorrect.
While reviewing packet capture logs can help verify behavior, it is not a required step in the configuration of control plane ACLs, but rather a troubleshooting measure.