Catalyst 9800 EoIP Tunnel Encryption Design
An engineer designs a new wireless network that uses a Cisco Catalyst 9800 Series wireless controller. The controller must be in a DMZ. The internal network is to be at the main on-premises data center of the customer. In addition, the customer wants to establish an EoIP tunnel to a Cisco 5520 WLC that is in a regional office. How must this requirement be incorporated into the design?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of interoperability between CAPWAP-based (Catalyst 9800) and EoIP-based (AireOS) controllers, specifically highlighting that AireOS requires explicit configuration for control plane encryption in these tunnels.
This question addresses the encryption requirements for an EoIP tunnel between a Catalyst 9800 WLC and a legacy 5520 WLC. The correct design choice involves configuring control plane encryption on the AireOS device to ensure secure mobility.
Many candidates choose Option A, mistakenly believing that enabling data plane encryption on the Catalyst 9800 is the primary requirement, or they overlook that AireOS does not support CAPWAP natively without specific mobility group configurations.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct answer because the scenario involves an EoIP tunnel connecting a modern Catalyst 9800 (IOS-XE) to a legacy Cisco 5520 (AireOS). While the Catalyst 9800 enables control plane encryption by default, the AireOS controller requires manual configuration to enable encryption for the mobility tunnel. Specifically, the commandconfig mobility group member <peer-ip> encrypted must be used on the 5520 to encrypt the control plane traffic between the two controllers.Why the Other Options Are Wrong
Options A and D refer to data plane encryption. While data plane encryption (DTLS) can be enabled, it is optional and often disabled for performance reasons in large deployments; it is not the mandatory requirement for establishing the tunnel itself. Option C is incorrect because the Catalyst 9800 has control plane encryption enabled by default, so no action is needed there. Option B correctly identifies that the AireOS side is the one requiring configuration to support secure mobility with the IOS-XE peer.Community Comment Notes
Community consensus heavily favors Option B, noting that 'on the 9800 WLC, control plane encryption is always enabled' which shifts the burden to the AireOS side. One user highlighted that 'support for IRCM with Catalyst 9800 wireless controller is present only in 8.8.111 and above,' confirming the need for proper AireOS configuration. Another comment clarified that while some believe EoIP is unsupported, the question premise establishes its use, making the encryption configuration the key decision point.Official Reference
Exam Strategy
When dealing with mixed-controller environments (IOS-XE and AireOS), always check which platform requires manual intervention for security features. Remember that AireOS is legacy and often defaults to less secure settings compared to the modern, secure-by-default IOS-XE platforms.
Frequently Asked Questions
Why is control plane encryption mandatory on the 5520?
The Catalyst 9800 enforces control plane encryption by default. To maintain a secure mobility tunnel, the legacy AireOS 5520 must also have this feature explicitly enabled via configuration.
Does the Catalyst 9800 need data plane encryption configured?
No, data plane encryption is optional. The critical requirement for interoperability and security in this specific EoIP scenario is ensuring the control plane is encrypted on both ends, which defaults to true on the 9800 but false on the 5520.