A warehouse is turning on 802.1X across its wireless LAN. Employees authenticate with EAP-TLS certificates, contractors use EAP-PEAP, two ISE policy service nodes provide redundancy, and after posture ISE must change a session's VLAN while the user stays connected. The controller's RADIUS server list is still empty. Which controller RADIUS configuration supports this deployment?
Select an answer to reveal the explanation.
Short Explanation
Add both ISE policy nodes to your controller’s RADIUS server list with matching shared secrets, then enable CoA. You’ll get RADIUS redundancy and let ISE change your active session’s VLAN after posture, like switching lanes without stopping; make sure your ISE policies support both EAP methods and return the right VLAN.
Full Explanation
The controller is a RADIUS client, so each ISE policy service node must be configured as a RADIUS server with a shared secret matching the one configured for that controller in ISE. Configuring both nodes supports redundancy, assuming the controller is configured to use the available servers. CoA lets ISE send a dynamic authorization request to the controller; for a posture-driven VLAN change, the controller and ISE must support the required CoA behavior, and the WLAN must allow the controller to apply the returned authorization, including the VLAN. CoA does not itself guarantee that a VLAN will change without a disconnect; that depends on the controller, its configuration, and the authorization flow. ISE must allow both EAP-TLS and EAP-PEAP to meet the stated client requirements. A configuration with only one RADIUS server does not provide the stated two-node redundancy, and disabling CoA does not support the requested CoA-based mid-session change. Confirm that the WLAN uses the configured RADIUS servers for client authentication and that the required AAA override settings are enabled.