Catalyst 9800 EoIP Tunnel Encryption Design

300-425 By islever Editorial Last updated

Short answer

B Use AirOS code that supports encryption of the control plane on the 5520 WLC.

Question

An engineer designs a new wireless network that uses a Cisco Catalyst 9800 Series wireless controller. The controller must be in a DMZ. The internal network is to be at the main on-premises data center of the customer. In addition, the customer wants to establish an EoIP tunnel to a Cisco 5520 WLC that is in a regional office. How must this requirement be incorporated into the design?
  1. Use Cisco IOS-XE code that supports encryption of the data plane on the Catalyst 9800 WLC.
  2. Use AirOS code that supports encryption of the control plane on the 5520 WLC. Correct Answer
  3. Use Cisco IOS-XE code that supports encryption of the control plane on the Catalyst 9800 WLC.
  4. Use AirOS code that supports encryption of the data plane on the 5520 WLC.

Key Takeaways

The exam tests knowledge of interoperability between CAPWAP-based (Catalyst 9800) and EoIP-based (AireOS) controllers, specifically highlighting that AireOS requires explicit configuration for control plane encryption in these tunnels.

This question addresses the encryption requirements for an EoIP tunnel between a Catalyst 9800 WLC and a legacy 5520 WLC. The correct design choice involves configuring control plane encryption on the AireOS device to ensure secure mobility.

Common mistake: Many candidates choose Option A, mistakenly believing that enabling data plane encryption on the Catalyst 9800 is the primary requirement, or they overlook that AireOS does not support CAPWAP natively without specific mobility group configurations.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because the scenario involves an EoIP tunnel connecting a modern Catalyst 9800 (IOS-XE) to a legacy Cisco 5520 (AireOS). While the Catalyst 9800 enables control plane encryption by default, the AireOS controller requires manual configuration to enable encryption for the mobility tunnel. Specifically, the command config mobility group member <peer-ip> encrypted must be used on the 5520 to encrypt the control plane traffic between the two controllers.

Why the Other Options Are Wrong

Options A and D refer to data plane encryption. While data plane encryption (DTLS) can be enabled, it is optional and often disabled for performance reasons in large deployments; it is not the mandatory requirement for establishing the tunnel itself. Option C is incorrect because the Catalyst 9800 has control plane encryption enabled by default, so no action is needed there. Option B correctly identifies that the AireOS side is the one requiring configuration to support secure mobility with the IOS-XE peer.

Community Comment Notes

Community consensus heavily favors Option B, noting that 'on the 9800 WLC, control plane encryption is always enabled' which shifts the burden to the AireOS side. One user highlighted that 'support for IRCM with Catalyst 9800 wireless controller is present only in 8.8.111 and above,' confirming the need for proper AireOS configuration. Another comment clarified that while some believe EoIP is unsupported, the question premise establishes its use, making the encryption configuration the key decision point.

Exam Strategy

When dealing with mixed-controller environments (IOS-XE and AireOS), always check which platform requires manual intervention for security features. Remember that AireOS is legacy and often defaults to less secure settings compared to the modern, secure-by-default IOS-XE platforms.

Frequently Asked Questions

Why is control plane encryption mandatory on the 5520?

The Catalyst 9800 enforces control plane encryption by default. To maintain a secure mobility tunnel, the legacy AireOS 5520 must also have this feature explicitly enabled via configuration.

Does the Catalyst 9800 need data plane encryption configured?

No, data plane encryption is optional. The critical requirement for interoperability and security in this specific EoIP scenario is ensuring the control plane is encrypted on both ends, which defaults to true on the 9800 but false on the 5520.

More 300-425 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Bandito 👍 7 Answered B
    On the 9800 WLC, control plane encryption is always enabled, which means that you need to have secure mobility enabled on the AireOS side. However, data link encryption is optional. If you enable it on the 9800 side, enable it on AireOS with: config mobility group member data-dtls enable https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213913-building-mobility-tunnels-on-catalyst-98.html
  2. Love2Cod3 👍 1 Answered B
    Provided answer is correct. "AireOS uses EoIP tunnels for mobility. Support for CAPWAP based encrypted mobility (Secure Mobility) was brought in in 8.5. However the support for IRCM with Catalyst 9800 wireless controller is present only in 8.8.111 and above and in the 8.5 IRCM supported release." https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-8/b_c9800_wireless_controller-aireos_ircm_dg.html#id_85243
  3. Farhad123 👍 1
    B is correct , encryption of the control plane regarding 5520 is required. for 9800 we dont need to enable encryption for control plan as it is enabled by default
  4. Jonycici 👍 1
    Question is tricky because 9800s don't support EoIP tunnel, only UDP 16667 for data.
  5. Farhad123 👍 1 Answered A
    Need to correct my previous answer , A is correct .

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Wireless Location Services AP Hearing Requirements

S-grade

Anchor Controller Code Upgrade Benefits 8.1+

S-grade

Predictive Wireless Design Power Level for Location Readiness

S-grade

Enabling Roaming Recommendations for VoWLAN Clients

S-grade

← Back to 300-425 Study Guide