A branch WLAN is supposed to authenticate employees with ISE. The WAN is up, and ISE shows no requests. The WLAN is set to authenticate locally at the access point. What should change?
Select an answer to reveal the explanation.
Short Explanation
The branch is answering the login itself, so ISE never hears the question. Your WAN is up. Send the employees to ISE with central authentication, because hiding the name does not move the authenticator.
Full Explanation
Local authentication at the access point answers the client from the branch and does not send a RADIUS request to ISE. That matches a WAN that is up and an ISE log that stays empty. Central authentication makes the controller send those employees to ISE. Shutting the WAN does the opposite of reaching ISE. ISE cannot be queried more easily when the path is down. Sniffer mode captures frames and does not forward authentication. A hidden SSID does not move the authenticator from the access point to ISE. The branch WLAN is set to local authentication on the access point, so ISE never sees the users. Central authentication sends them to ISE while the WAN is up. Check one live client after the change and do not retune the rest of the floor until that client matches the result you expected. Exam caveat: local authentication is a useful fallback for a WAN failure, and it is the wrong mode while the WAN is up and ISE is the required identity store. Operational check: switch the WLAN to central authentication and confirm a test employee produces a request in the ISE log.