Exam 300-430 topic 1 question 213 discussion

- Therefore, if CPU ACLs are enabled in the WLC, an allow rule for the virtual interface IP is required (In ANY direction) in these conditions: - When the CPU ACL does not have an allow ALL rule for both directions. - When there exists an allow ALL rule, but there also exists a DENY rule for port 443 or 80 of higher precedence. - The allow rule for the virtual IP must be for TCP protocol and port 80 if secureweb is disabled, or port 443 if secureweb is enabled. This is needed in order to allow the access of the client to the virtual interface IP address post successful authentication when CPU ACLs are in place. https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/108501-webauth-tshoot.html

B is correct one

Looking at the exhibit, ACL named "mgmt" is applied as CPU ACL, and line Seq 3 is permitting traffic to the WLC Virtual IP ADD already (so option C is not correct, it is a redundant statement). What that line needs is to be amended, to both directions.

B is correct one

A is correct - Option B is not the correct answer because the permit statement for 192.0.2.100 being in both directions does not directly address the issue of the Web Authentication Redirect page not working. Option C is also not the correct answer because the Web Authentication Redirect does not need to be configured on the CPU ACLs. The issue lies with the CPU ACL implementation and not the configuration of the Web Authentication Redirect itself.

spoto answer A

answer is B as per the below - Therefore, if CPU ACLs are enabled in the WLC, an allow rule for the virtual interface IP is required (In ANY direction) in these conditions: - When the CPU ACL does not have an allow ALL rule for both directions. - When there exists an allow ALL rule, but there also exists a DENY rule for port 443 or 80 of higher precedence. https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/108501-webauth-tshoot.html

C is correct. From https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-2/config-guide/b_cg82/b_cg82_chapter_01110.html. When you apply CPU ACLs on a Cisco 5508 WLC or a Cisco WiSM2, you must permit traffic towards the virtual interface IP address for web authentication. The packet direction does not have any significance, it is always ‘Any’.