Question

A network engineer is designing BYOD onboarding for a Cisco WLC deployment. The requirement is that employees first associate to an open (or PSK) provisioning SSID to register their device and download the native supplicant profile and certificate, then move to a secure 802.1X SSID for production access. Which BYOD deployment model does this describe, and what must the WLC configuration include to support the transition?

Accepted Answer

Dual-SSID model; the open/PSK SSID must have MAC filtering enabled with the RADIUS NAC/ISE NAC state and an ISE-referenced redirect ACL to send users to the BYOD portal

Answer

Single-SSID model; the WLC must be configured with an override for the redirect ACL so the same SSID re-authenticates the endpoint after provisioning

Answer

Single-SSID model; the WLC must disable CoA so the client stays on the provisioning SSID until the certificate installs

Answer

Dual-SSID model; both SSIDs must be configured for 802.1X with EAP-TLS so the endpoint never needs to be redirected to a portal