On a branch office deployment, it has been noted that if the FlexConnect AP is in standalone mode and loses connection to the WLC, all clients are disconnected, and the SSID is no longer advertised. Considering that FlexConnect local switching is enabled, which setting is causing this behavior?
The behavior described in the question suggests that the SSID is no longer advertised and all clients are disconnected due to the AP losing connection to the WLC while in standalone mode. This is likely because ISE NAC (Network Admission Control) is enabled. When NAC is enabled, it requires real-time communication with the WLC to validate client access. If the connection to the WLC is lost, the AP cannot perform the necessary NAC validations, leading to the disconnection of clients and the cessation of SSID broadcasts.
The question stated the AP lost connection therefore all connected users would loose connectivity and have to reauthenticate. If Flexconnect Local Auth has been disabled this behavior would occur. The provided answer is correct.
As per cisco documentation All 802.11 authentication and association processing occurs regardless of which operational mode the AP is in. When in connected mode, the FlexConnect AP forwards all association/authentication information to the WLC. When in standalone mode, the AP cannot notify the WLC of such events, which is why WLANs that make use of central authentication/switching methods are unavailable.
Not D. Disabling local auth cannot dissconnect already authenticated clients and cannot impact on broadcasting SSID
Well whats the answer then if it isn't D?
D is rite
D is wrong because in standalone mode existing clients are not de-authenticated and the SSID remains up and locally switched. NAC enabled WLANs however REQUIRE a connection to the WLC. When the WLC connection is lost NAC enabled SSID must therefore become disabled and users deleted.
Hello, I'm going to take my exam next month and I'm not sure about this question. Would it really be option A?
Answer: A Note: RADIUS Network Admission Control (NAC) is not supported when the FlexConnect AP is in disconnected mode. Thus, if the FlexConnect AP is in standalone mode and loses connection to the WLC, all clients are disconnected, and the SSID is no longer advertised. source: most_ahdy - link: https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113606-byod-flexconnect-dg-000.html
Right straight from Cisco Site, A is 100% correct
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113606-byod-flexconnect-dg-000.html I think it is A
I think D is the cause of the issue, as the WLC puts clients on the exclusion list because of multiple consecutive failed authentication attemps to the central authentication server, thus denying the client from the network.
When FlexConnect local switching is enabled, the clients are associated directly with the FlexConnect AP. If the AP loses connection to the WLC, the clients should still be able to communicate with each other on the local network. However, if Client Exclusion is enabled and the AP cannot communicate with the WLC, it will remove all associated clients, and the SSID will no longer be advertised. This behavior can be changed by disabling Client Exclusion on the WLC.
Maybe B.... https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html.xml
Or D....assuming that the configuration are central switching and central authentication: "authentication down, switch down—In this state, the WLAN disassociates existing clients and stops sending beacon and probe requests. This state is valid in both standalone mode and connected mode." https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/flexconnect.html
Any idea if these questions are still valid for the exam? Any recent attempts anyone?
MAC Filtering is not supported on FlexConnect access points in standalone mode. However, MAC Filtering is supported on FlexConnect access points in connected mode with local switching and central authentication. Also, Open SSID, MAC Filtering, and RADIUS NAC for a locally switched WLAN with FlexConnect access points is a valid configuration where MAC is checked by ISE. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/flexconnect.html#:~:text=MAC%20Filtering%20is,checked%20by%20ISE.