A retail chain is moving its corporate laptops to WPA2-Enterprise on Cisco WLCs with ISE. The laptops carry machine certificates and must authenticate with EAP-TLS, authentication must be handled by ISE rather than the controller, and the controller must accept ISE CoA so access can change mid-session. Which controller configuration satisfies all three requirements for wireless 802.1X?

The correct configuration meets all three requirements: the laptop’s machine certificate is used for EAP-TLS, ISE terminates and evaluates the 802.1X authentication through the WLC’s RADIUS relationship, and the controller is configured to accept ISE’s Change of Authorization messages. PEAP with password-based credentials is a commonly deployed ISE method and can use the same RADIUS and CoA arrangement, but it does not authenticate these laptops with the required EAP-TLS certificate method. Disabling CoA preserves EAP-TLS authentication on ISE but prevents the controller from applying ISE-initiated mid-session changes, such as a policy-driven reauthorization or session termination. A WLC’s local EAP-TLS server can authenticate clients in deployments using controller-based authentication, but that puts authentication on the controller rather than ISE, contrary to the stated architecture. Exam caveat: distinguish where EAP is terminated from which device forwards RADIUS; a WLC acting as the authenticator does not mean it must perform the EAP authentication itself. Practical check: verify the WLAN’s 802.1X/RADIUS settings point to ISE, confirm the ISE policy selects EAP-TLS, and test that an ISE CoA request changes or terminates an active client session on the WLC.