Examkin

Question

Difficulty: MediumAP and WLC Management Access Connections

A network administrator configures a dynamic interface named 'GUEST_DATA' on VLAN 30 on a Cisco Wireless LAN Controller (WLC). The administrator attempts to initiate an SSH session to the IP address assigned to the 'GUEST_DATA' interface for administrative tasks, but the connection is refused. However, SSH access to the WLC Management Interface IP address on VLAN 10 functions properly from the same administrative workstation. Which condition explains why administrative SSH access to the dynamic interface IP address is failing?

  1. By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.Answer
  2. B
    Dynamic interfaces automatically transition into FlexConnect mode, which drops all inbound management packets when connected to an upstream Layer 2 switch port.
  3. C
    The upstream Catalyst switch trunk port must have its 802.1Q native VLAN changed to match VLAN 30 before dynamic interface administrative access is accepted.
  4. D
    The WLC blocks inbound management connections on dynamic interfaces until CDP neighbor TLV messages confirm the upstream connection is configured as a trunk.

Answer

By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.
On Cisco Wireless LAN Controllers, administrative access protocols (such as SSH, HTTPS, Telnet, and SNMP) are restricted by default to the Management Interface and the out-of-band Service Port. Dynamic interfaces are created to connect wireless client WLANs to specific wired VLANs, and by default, management traffic directed to dynamic interface IP addresses is ignored/refused for security reasons.

Step-by-Step Solution

1
Identify the functions and roles of WLC logical interfaces (Management Interface, Service Port, and Dynamic Interfaces).
The Management Interface is the primary in-band interface used for controller management and AP CAPWAP tunnels. Dynamic interfaces function like VLAN interfaces for carrying user client traffic.
Understanding interface segregation on Cisco WLCs helps determine where administrative services (SSH/HTTPS) are listening.
2
Analyze default access control rules for management protocols on Cisco WLC interfaces.
Management access over dynamic interfaces is disabled by default to prevent wireless clients on guest or data VLANs from reaching management daemons on the WLC.
Restricting management connections strictly to dedicated management paths maintains security hygiene across wireless segments.

Key Concept

WLC Management Interface Access vs Dynamic Interface Roles
Rate this question

Topics

AP and WLC Management Access Connections

More questions from this topic