I85PREP
⌘ K
ENWLSI 300-430 study materials
ENWLSI 300-430 study resources

ENWLSI 300-430: Implementing Cisco Wireless Security

ENWLSI 300-430 · Work through your exam, one topic at a time.

All guide sections

Implementing Cisco Wireless Security

The Implementing Cisco Wireless Security domain tests layer-2 security selection (WPA2/WPA3, PSK vs 802.1X), RADIUS integration with ISE, dynamic authorization, ACL enforcement, client exclusion, management frame protection and rogue handling.

Layer-2 and AAA basics

  • WLAN security options: WPA2-PSK/AES, WPA2-802.1X, WPA3-SAE, WPA3-Enterprise, and open with web auth. WPA3 personal and enterprise require PMF (802.11w), so legacy clients cannot join those WLANs.
  • With 802.1X the controller is the authenticator; EAP exchanges (PEAP, EAP-TLS, EAP-FAST) are relayed to ISE. Local EAP is a fallback profile when RADIUS is unreachable.
  • Enable RADIUS accounting if you need session start/stop and interim records for ISE posture and reporting.
  • CoA (RFC 5176, UDP 3799) lets ISE push a new authorization (VLAN, ACL) mid-session - but only if AAA override is enabled on the WLAN.

Access control and hardening

  • Pre-auth and post-auth ACLs on AireOS; ACLs referenced from the policy profile on Catalyst 9800; URL ACLs for redirect filters.
  • Client exclusion: after N failed authentications the MAC is excluded for a timer, producing "excluded" client states that mask the original failure.
  • MFP: infrastructure MFP protects management frames between APs and the controller; client MFP is 802.11w. A mismatch shows up as association or exclusion failures.
  • Rogue AP states are friendly, alert and malicious; auto-containment is only legitimate against rogues detected on your own wired network.

Worked example

ISE returns VLAN 30 and ACL GUEST-ACL, but the client keeps landing in VLAN 10. Reasoning: authentication succeeded, so the RADIUS accept is fine, but returned attributes are ignored when Allow AAA Override is unchecked on the WLAN. Enable it, confirm VLAN 30 exists as a dynamic interface (AireOS) or as a policy-profile VLAN (9800), then re-test.

Traps that cost marks

  • AAA override disabled, so ISE-returned VLAN/ACL attributes are silently discarded.
  • CoA blocked by a firewall between ISE and the controller on UDP 3799.
  • MAB attempted on a WLAN without MAC filtering enabled.
  • Treating client exclusion as the fault instead of clearing it and reading debug client for the real EAP failure.