Examkin

Question

Difficulty: HardCisco Wireless Architectures and AP Modes

A network engineer is operating a remote branch office where Lightweight Access Points are deployed in FlexConnect mode with local switching and central authentication. If the WAN link connecting the branch AP to the central Wireless LAN Controller (WLC) fails, how does the AP process existing connected client data traffic and new 802.1X client authentication attempts?

  1. Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.Answer
  2. B
    Existing client data traffic is dropped immediately, and the AP drops all client associations while seeking a fallback WLC.
  3. C
    Existing client data frames are buffered locally in AP memory until the CAPWAP control tunnel to the WLC is re-established.
  4. D
    Existing client data traffic continues to be bridged locally, and the AP automatically performs 802.1X EAP authentication locally for all new incoming client attempts.

Answer

Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.
When a FlexConnect AP configured for local switching loses CAPWAP connectivity to its controlling WLC, it enters standalone mode. Existing clients using local switching continue to have their data traffic bridged directly onto the local network interface. However, because authentication is set to central authentication, the AP cannot process new 802.1X client requests without WLC access to reach the RADIUS server, causing new authentications to fail.

Step-by-Step Solution

1
Analyze the FlexConnect mode configuration parameters.
The AP is operating with local switching for data frames and central authentication for control/security operations via the WLC.
FlexConnect separates the data plane and control plane according to configured WLAN profiles.
2
Evaluate the impact of WAN link failure on existing active client sessions.
Data traffic for already authenticated clients is switched directly to the local Ethernet switch port of the AP without passing through the CAPWAP data tunnel.
Local switching allows the AP to continue forwarding client VLAN traffic locally during WLC standalone mode.
3
Evaluate the impact of WAN link failure on new 802.1X authentication requests.
New authentication requests fail because central authentication relies on the active CAPWAP control tunnel to reach the central WLC and RADIUS infrastructure.
Without active CAPWAP control connectivity or configured local backup authentication methods, the AP cannot process 802.1X EAP exchanges.

Key Concept

FlexConnect Standalone Mode Operations for Central Authentication and Local Switching
Estimated Time:2m 0s
Rate this question

Topics

Cisco Wireless Architectures and AP Modes

More questions from this topic