A logistics firm runs an AireOS wireless LAN where corporate laptops authenticate with EAP-TLS certificates and badge printers and cameras rely on MAC authentication bypass. After a posture check, ISE must still be able to push a CoA reauthorization that moves a laptop to a quarantine VLAN. Which WLAN configuration on the WLC supports both client types and that reauthorization?
Select an answer to reveal the explanation.
Short Explanation
Set the WLAN’s Layer 2 security to 802.1X with MAC filtering enabled, then configure ISE as a RADIUS server with RFC 3576 support and a matching shared secret. It’s like a door with two readers: your laptops use certificates, while your cameras and badge printers use MAC addresses, and ISE can send a CoA to move a laptop to quarantine.
Full Explanation
The correct configuration supports both authentication paths on the WLAN: 802.1X lets corporate laptops authenticate with their EAP-TLS certificates, while MAC filtering allows the badge printers and cameras to use MAC authentication bypass through RADIUS. Enabling RFC 3576 on the WLC and configuring ISE with the matching shared secret lets ISE send dynamic authorization messages, including a reauthorization that can apply the quarantine VLAN. A separate dynamic-authorization secret that differs from the one configured on ISE breaks CoA validation, even if ordinary RADIUS authentication is working. Replacing EAP-TLS with PEAP may be a common 802.1X design, but it does not meet the stated certificate-authentication requirement for the laptops. Applying a quarantine ACL through CoA can restrict traffic, but it does not satisfy the specific requirement to move the laptop into a quarantine VLAN. Exam caveat: MAC filtering is the WLAN control that permits MAB; it does not by itself determine whether MAC addresses are checked locally or by ISE, so verify the configured authentication source. Practical check: test a certificate-authenticated laptop and a MAB device, then trigger posture remediation and confirm the CoA exchange succeeds and the laptop receives the quarantine VLAN.