300-425 — Frequently Asked Questions

Hostnames are administrative identifiers for management. They do not affect RF signal propagation or link quality, which are the primary concerns of a site survey.

Configuration sets up logical attributes (like bridge groups). A site survey validates physical performance by measuring Tx and Rx power levels to ensure reliable connectivity.

BSS transition (802.11v) is a client steering policy that informs devices about available APs, so it applies per SSID context.

No, optimized roaming thresholds like RSSI limits are specific to the radio band (2.4GHz or 5GHz) and must be set at the radio level.

The Catalyst 9800 enforces control plane encryption by default. To maintain a secure mobility tunnel, the legacy AireOS 5520 must also have this feature explicitly enabled via configuration.

No, data plane encryption is optional. The critical requirement for interoperability and security in this specific EoIP scenario is ensuring the control plane is encrypted on both ends, which defaults to true on the 9800 but false on the 5520.

Using 50 mW assumes all clients can transmit at that power, leading to oversized cell predictions and inaccurate location data since most clients have lower TX power.

In predictive design for location readiness, the goal is accuracy of the model relative to client limits, not necessarily maximizing range. It simulates the worst-case client scenario.

802.11k provides neighbor lists to help clients scan efficiently, while 802.11v provides BSS Transition Management to actively recommend or steer clients to better APs.

No, 802.11r focuses on fast security key transitions to reduce roaming latency, not on the decision-making process of which AP to roam to.

Three APs allow for basic 2D triangulation, but four APs are required for location-ready designs to ensure accuracy, reliability, and handling of signal variations.

It is the minimum signal strength required for a location-ready AP to be considered 'heard' by another AP for the purpose of calculating position data.

A router operates at Layer 3. A Workgroup Bridge acts as a transparent bridge (Layer 2). Connecting clients requires a Layer 2 device like a hub or switch to fan out the connection.

Technically yes, but since 'Switch' is not an option, 'Hub' is the accepted answer for Layer 2 extension in this context. The switch may be assumed to be used for the AP itself or other infrastructure.

Each switch in a Catalyst 9300X stack manages its own PoE budget independently. The 1100W PSU provides ~590W locally, so you cannot draw from Switch 1's spare power to feed Switch 2.

A 1900W PSU increases the PoE budget to ~1,100W. This would allow more APs per switch (~36 at 30.5W), potentially allowing all ports if the design includes this upgrade, but the question implies default hardware.

Regular ping uses ICMP and tests layer 3 reachability. Mping sends encapsulated mobility packets to test if the specific UDP ports required for controller roaming are open and functional.

Mping uses the configured mobility peer IP address to establish the session. While the source might be the management interface, the destination must be the peer's mobility address.

Yes, but the AireOS WLC must be configured with the certificate hash key of the 9800 to establish a secure control path.

Encrypted mobility is a valid configuration. It only fails if the receiving end (AireOS) lacks the necessary certificate trust configuration.

Passive mode only listens to beacons, avoiding association overhead. This makes it faster for visualizing signal strength and coverage areas.

It increases efficiency by allowing parallel channel scanning. It doesn't necessarily improve per-point accuracy but drastically reduces total survey time.

While 3 APs allow for basic trilateration, Cisco recommends 4 APs per floor to ensure redundancy and higher accuracy for location services.

Location-ready implies the infrastructure supports it; Cisco mandates a minimum of 4 APs/floor to ensure this capability functions reliably in production.

Prior to 8.1, round-robin was used. Version 8.1+ introduced priority-based selection to optimize traffic flow and allow primary/secondary anchor designation.

No, the changes occur at the controller level (control plane). Client WLAN card drivers do not need to be upgraded to support the new anchor selection logic.

A -70 dBm device is less sensitive and needs a stronger signal than -73 dBm, so it cannot validate the minimum RF requirement or represent the worst-case client.

It means the least sensitive client—the one with the highest dBm threshold—so you design for the device that needs the strongest signal.

It shrinks cell size but doesn't add spectrum or isolate cells, so overlap remains if channels are reused.

No, it's a client-side battery-saving feature and has no effect on AP channel planning or interference.

Voice requires specific Signal-to-Noise Ratio (SNR) guarantees, typically >25dB, which are not mentioned in the scenario. Only RSSI is provided.

Yes, -67 dBm is generally considered the minimum threshold for reliable HD video streaming and data connectivity in enterprise Wi-Fi designs.

802.11a is limited to 20 MHz channels, so admitting those clients prevents the AP from using 40/80 MHz bonding for 802.11ac — the requirement restricts channel width rather than expanding it.

Both 802.11a and 802.11ac operate only in the 5 GHz band, so adding these clients puts no additional load on the 2.4 GHz spectrum.

EoIP is only supported between two AireOS controllers, so it cannot tunnel mobility or anchored guest traffic between an AireOS anchor and a Catalyst 9800 foreign controller.

IRCM lets controllers running different software releases interoperate, which is required so the 9800 foreign controller can roam guests to AireOS anchors over secure mobility tunnels.

No. OfficeExtend is a controller feature you enable on supported Aironet AP models once a base license is installed and in use; Cisco sells no separate OEAP license SKU.

No. Plus and WPlus are capacity/entitlement tiers for the controller; the OEAP prerequisite in the 8.3 configuration guide is the base license.

With nine APs in one space, 2.4 GHz has only three non-overlapping channels, so static settings cannot eliminate co-channel reuse. Disabling selected 2.4 radios reduces active cells while remaining APs cover the area.

It can shrink the 2.4 GHz cell and reduce interference, but it may create coverage holes. The question requires maintaining 2.4 GHz coverage, so selective radio disabling is the better design choice.

FlexConnect alone doesn't explicitly satisfy the requirement for bridge mode APs; combining Flex + Bridge ensures mesh bridging with local switching.

Bridge mode APs in mesh tunnel all client traffic to the WLC by default; FlexConnect mode enables local switching to reduce that tunneled traffic.

802.3at (PoE+) provides up to 30W at the switch port, which is enough for typical Wave 2 APs; the bottleneck is the 1 Gbps wired uplink.

It can power them and pass traffic, but it may not carry the full wireless throughput since Wave 2 APs can exceed 1 Gbps over the air.

Beacons, probes and other management frames are transmitted at the lowest mandatory/basic rate, so 24 Mbps must be Mandatory; Supported rates only advertise client data capabilities.

802.11b is the 2.4 GHz DSSS PHY with a maximum 11 Mbps rate, so it supports neither 40 MHz channel bonding nor a 24 Mbps rate.

In Cisco Auto-Anchor Mobility, anchor priority runs from 1 (highest) to 3 (lowest). Assigning 1 to the primary DMZ anchor makes it the first anchor selected for guest clients.

No. ECMP is a routing load-balancing mechanism, while Auto-Anchor Mobility selects the DMZ anchor through the priority value in the mobility group's anchor list.

The exhibit explicitly shows data-dtls disabled on the AireOS 5520; the 9800-CL default data DTLS state is enabled, so the mismatch originates on the AireOS side.

Enable data DTLS on the AireOS 5520 with config mobility group member data-dtls <mac> <hash>, or disable data DTLS on the 9800-CL to match.

MIC authentication only verifies that mobility peers are legitimate and that their messages are intact; it does not encrypt the data and control traffic in the mobility tunnel, so device-to-device confidentiality is not achieved.

No. The group name is a shared identifier that members must match to form the group; it hardens nothing by itself and can never substitute for enabling Mobility Encryption on the controllers.

Members with mismatched group names do not join the same mobility group, so the EoIP tunnels between the AireOS and IOS-XE controllers never come up and mobility breaks entirely.

It watches client RSSI and pushes below-threshold clients toward a better AP with 802.11v BTM frames; Disassociation Imminent only adds the roam-or-be-kicked timer flag.

No. 802.11r only shortens re-authentication during a roam and does not control whether the WLC issues a BSS Transition Management request, so option B cannot fix the unexpected roaming.

The 9800 WLC LAG does not support LACP or PAgP negotiation; the switch ports must be configured as an unconditional or always-on EtherChannel.

Multi-LAG is not the documented feature for this single-WLC cable redundancy scenario; LAG is the mechanism that bundles distribution ports and load-balances APs.

It maps each shop's WLAN to a unique VLAN, so clients roaming within the shop stay on the same subnet and achieve Layer 2 roaming without changing IP addresses.

No, disabling both bands would disable Wi-Fi entirely; roaming optimization focuses on VLAN design and fast transition protocols, not turning off radios.

No, AP Fallback is a feature that must be explicitly enabled on the Wireless LAN Controllers. If disabled, APs will stay on the backup controller.

Secondary WLC config ensures the AP can join during a failure. The problem is returning to the primary, which depends on Fallback being enabled and Primary info being correct.

The HQ Catalyst 9800 WLC is configured as the N+1 backup, so the campus does not need a local standby EWC AP; one EWC AP per campus meets the design requirements.

Because the employee WLAN uses 802.1x PEAP authentication via HQ ISE, the EWC must be able to reach that RADIUS server, but client traffic remains local after authentication.

Cisco recommends 15-20% overlap for voice; 15% supports roaming while 25% is excessive and increases interference without improving location accuracy.

Location trilateration requires at least three APs to hear a client; corner placement ensures edge clients are detected by multiple APs, improving location accuracy.

mping is not the EoIP data-path test; the question specifically requires validating mobility EoIP data packet communication, which eping performs between controllers.

eping sends an Ethernet ping over the EoIP tunnel to a peer controller, verifying that the mobility data path is operational between mobility group members.

They are older AireOS appliances licensed with PAK, eDelivery and evaluation licenses; the RTU model is not supported on them, so there is no RTU entitlement to carry over.

No. vWLC capacity is licensed for the virtual instance itself (evaluation, then a purchased virtual-controller license), separate from the RTU entitlement on the physical 3504/5520.

Cisco rates 5 Gbps over Cat5e at a maximum of 70 m; 90 m exceeds that. The 100 m limit applies to 2.5 Gbps or to Cat6.

The IEEE standard allows 5GBASE-T over Cat5e up to 100 m in ideal conditions, but Cisco's 3800 deployment guide specifies 70 m for guaranteed 5 Gbps.

Coverage hole detection adjusts radio power or data rates when clients hit low RSSI thresholds; it does not send the 802.11v BSS Transition Management Request used for client steering.

It sets how long the AP waits after sending a BSS Transition Management Request for the client to move to a better AP before the AP disassociates the client.

Sniffer mode captures packets to a remote analyzer and is not the continuous off-channel scan that Monitor mode provides for dual-band rogue detection.

Slot 1 is the fixed 5 GHz radio, and all SSIDs are 5 GHz only, so it must serve clients; the XOR radio handles dual-band monitoring without disrupting connectivity.

A WGB cycles through every channel in its scan list looking for a parent AP, so trimming the list to 52, 56, 60 and 64 keeps the bridge on-channel and off-scan less often.

Those channels are UNII-2 Extended (UNII-2C, 5470–5725 MHz), a separate band from the UNII-2/UNII-2A channels 52–64 the customer asked for.