Question

A network engineer is designing a single-SSID BYOD onboarding solution using a Cisco WLC and ISE with the internal CA. Employees connect to a WPA2-Enterprise SSID with their AD credentials via PEAP, and after registering their personal device they must transition to EAP-TLS on the SAME SSID without manually reconnecting to a different network. Which mechanism must the WLC support and ISE trigger to move the endpoint from the provisioning state to the certificate-authenticated state after the device is onboarded?

Accepted Answer

RADIUS Change of Authorization (CoA) to reauthenticate the session so the endpoint re-associates and presents its new certificate

Answer

A DHCP lease release forcing the endpoint to obtain a new IP address and reconnect to a dedicated provisioning SSID

Answer

A separate open guest SSID redirect that hands the endpoint back to the corporate SSID after enrollment

Answer

SNMP MAC notification traps from the WLC to signal ISE that the certificate has been installed