How to design EWC on Catalyst 9120 for branch campus with HQ 9800 backup?
A community bank has three campus locations and one HQ with the data center operations. Each campus location has four Cisco Catalyst 9120 APs. The data center has a Catalyst 9800 WLC with eight Catalyst 9120 APs. Poor WAN uplinks cause impacted branch AP and wireless client connectivity back to HQ, and each campus location is now planned to have its own EWC controller based on C9120 AP to keep traffic local. This new design must accommodate these requirements: • Guest WLAN will be routed locally. • Employee WLAN must be authenticated 802.1x PEAP via HQ data center ISE but can pass traffic locally once authenticated. • HQ WLC will be the primary backup WLC for each WLC. Which design approach should the consulting engineer take?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
You must recognize that a single C9120 AP in EWC mode can serve as the campus controller while the HQ 9800 provides N+1 backup, and that adding the HQ ISE as a RADIUS server enables local 802.1x authentication without anchoring employee traffic.
This scenario tests Cisco Catalyst 9120 Embedded Wireless Controller (EWC) design for branch campuses where local guest traffic and 802.1x employee authentication via HQ ISE must be balanced with HQ Catalyst 9800 WLC N+1 backup. The correct approach uses one EWC AP per campus, local web auth for guest, HQ AAA server for employee authentication, and the HQ 9800 as N+1 backup (D).
Many candidates choose C, converting two APs to EWC for active/standby, but the HQ WLC already provides the required backup and the scenario only calls for one EWC controller per campus; guest traffic must remain local, not anchored to HQ.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
D is correct because the requirement is for each campus to have its own EWC controller based on a C9120 AP, with the HQ Catalyst 9800 WLC as the primary backup (N+1). One C9120 AP per campus is converted to EWC mode and set as the preferred controller for the other three campus APs. The HQ 9800 is configured as the N+1 backup, which satisfies the high-availability requirement without needing a second local standby AP. For guest, local web authentication on the guest VLAN keeps guest traffic local, matching the requirement that guest WLAN be routed locally. For employees, the HQ data center ISE is added as an AAA/RADIUS server to the EWC, so 802.1x PEAP authentication occurs against ISE while client data traffic remains local after authentication.Why the Other Options Are Wrong
Option A is wrong because it anchors the campus guest WLAN to the HQ WLC for guest VLAN access, which contradicts the requirement to route guest traffic locally. It also converts two campus APs to EWC mode unnecessarily, since the HQ WLC serves as the N+1 backup instead of a local standby. Option B is wrong because it uses a guest anchor back to the HQ employee WLAN for the employee WLAN, which removes local traffic forwarding and misapplies the guest anchor concept to employee traffic. Option C is wrong because although it correctly uses local web auth and adds the HQ AAA server, it deploys two EWC APs as active/standby, which is redundant given the HQ WLC N+1 backup requirement and the small four-AP campus design.Community Comment Notes
The community consensus strongly favors D. One commenter explained that "one of the APs takes on the role of controller" for the other APs at the same location, confirming that a single EWC AP per campus is sufficient. Another commenter, Farhad123, stated: "we just need one AP from each to act as EWLC" and noted the main controller should be HA and HQ user added. Jonycici also confirmed, "D is correct." These comments align with the design choice of one EWC AP per campus, local guest web auth, HQ ISE for employee authentication, and HQ WLC as N+1 backup.Official Reference
Exam Strategy
Focus on the keyword 'local' — any design that anchors guest or employee traffic back to HQ is wrong because it contradicts the requirement to keep traffic local. Also remember that EWC on a single C9120 AP can serve as the campus controller, and an external 9800 WLC can be configured as N+1 backup, so you don't need a standby EWC AP.
Frequently Asked Questions
Why can a single C9120 AP serve as the EWC controller instead of two for active/standby?
The HQ Catalyst 9800 WLC is configured as the N+1 backup, so the campus does not need a local standby EWC AP; one EWC AP per campus meets the design requirements.
Why must the employee WLAN add the HQ ISE as an AAA server in EWC?
Because the employee WLAN uses 802.1x PEAP authentication via HQ ISE, the EWC must be able to reach that RADIUS server, but client traffic remains local after authentication.