A regional hospital runs WPA2-Enterprise with EAP-PEAP and ISE as its RADIUS server, with accounting enabled. When ISE sends a Change of Authorization to move a laptop into a restricted VLAN, the controller accepts the request and reauthenticates the session, yet the laptop stays in its original VLAN. Which WLAN setting must be enabled for the new VLAN attributes to take effect?
Select an answer to reveal the explanation.
Short Explanation
You've got the authentication part nailed, but a live session only changes when the WLAN is allowed to accept per-user updates, and that switch is AAA Override. Without it, the controller hears ISE and still keeps the original VLAN. It's like a hotel that takes your upgrade request yet never reassigns your room.
Full Explanation
AAA Override is the WLAN setting that allows the controller to apply authorization attributes returned by RADIUS, including a per-user VLAN and ACL. Here, ISE’s CoA is accepted and the session is reauthenticated, so the signaling and reauthorization have occurred; the missing step is allowing the WLAN to use the returned attributes rather than retaining its configured VLAN. Adding tunnel attributes to an ISE authorization profile is a valid part of dynamic VLAN design, but it does not make the controller apply them when AAA Override is disabled. Configuring the RADIUS server profile to recognize VLAN attributes likewise does not enable the WLAN to honor per-user authorization results; the relevant WLAN-level override must still be enabled. Setting the restricted VLAN as the WLAN’s default can place clients there, but it applies a common VLAN rather than moving this laptop according to its CoA result while preserving the usual VLAN for other users. Exam caveat: a successful CoA acknowledgement and reauthentication do not prove that the WLAN is configured to apply every attribute in the resulting authorization reply. Practical check: enable AAA Override on the affected WLAN, then verify that ISE returns the expected VLAN attributes and that the controller’s client session details show the restricted VLAN after CoA.