Configuring Allow AAA Override for Dynamic VLANs on Cisco WLC
Short answer
B Enable the Allow AAA override parameter on the WLAN profile to permit the Cisco WLC to accept and apply the VLAN tag returned by the RADIUS server instead of using the SSID-defined VLAN.
Question
Key Takeaways
The exam tests knowledge of the conflict between static SSID configurations and dynamic RADIUS policies; 'Allow AAA override' resolves this by prioritizing RADIUS instructions.
Learn how to configure 'Allow AAA override' on a Cisco Wireless LAN Controller to enable dynamic VLAN assignment based on RADIUS attributes for identity networking.
Common mistake: Engineers often confuse 'Change of Authorization' (CoA) with initial VLAN assignment. CoA modifies existing sessions, whereas 'Allow AAA override' is required for the initial session setup to respect the RADIUS VLAN response.
Expert Analysis
Dynamic VLAN Assignment via RADIUS
The question requires the Cisco Wireless LAN Controller (WLC) to accept a VLAN tag returned by the RADIUS server and apply it to the client's traffic. This is known as dynamic VLAN assignment based on identity networking.
Analysis of Options
- A. Change of Authorization (CoA): CoA allows an external entity (like ISE) to push policy changes to an active session after authentication. It does not handle the initial VLAN assignment during the 802.1X/EAPOL exchange. The WLC must receive the VLAN from the Access-Accept packet first; CoA is for subsequent updates.
- B. Allow AAA override: By default, the WLC applies the SSID-based VLAN configuration to all clients associated with that SSID. Enabling "Allow AAA Override" instructs the WLC to ignore the SSID-defined VLAN and instead use the VLAN attribute (or tunnel-group/AVP) provided in the RADIUS Access-Accept message. This is the specific parameter required to support identity-based VLAN assignment.
- C. FlexConnect: FlexConnect is a deployment mode for branch office access points where local switching occurs. While it supports VLAN mapping, it is an architectural choice, not the specific configuration parameter that enables the acceptance of RADIUS VLAN tags over standard controller-based architecture.
- D. CWA redirect ACL: This refers to Catch-Weight Authentication or web-auth redirections, typically used for guest access or captive portals, not for dynamic VLAN assignment in an identity networking context using 802.1X.
As noted in community feedback, enabling AAA override is the critical step because without it, the RADIUS VLAN recommendation is ignored in favor of the static SSID configuration.
Exam Strategy
When faced with questions about applying RADIUS-provided attributes (VLAN, QoS, ACL) dynamically, always look for 'AAA Override' or similar bypass mechanisms. Remember that default WLC behavior favors static SSID settings; you must explicitly enable overrides to trust the RADIUS server's initial authorization payload. Distinguish clearly between initial session establishment parameters and post-authentication modification tools like CoA.
Frequently Asked Questions
What happens if AAA override is disabled?
Is AAA override only for VLANs?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ArchyinVa 👍 1 Answered BThe correct configuration parameter is B. Allow AAA override. ### Key Concept: Identity Networking & AAA Override In Cisco wireless terminology, Identity Networking refers to assigning network policies—such as VLANs, QoS markings, or ACLs—dynamically to users based on their identity and authorization credentials rather than statically binding every user on an SSID to the same settings. Default Behavior: By default, when a client associates with a WLAN, the controller maps the client to the static VLAN/interface configured directly under the WLAN profile. Why "Allow AAA Override" is Required: When RADIUS-based authentication (such as 802.1X/EAP via Cisco ISE) is used, the RADIUS server returns IETF standard attributes in the Access-Accept packet to dynamically steer the client to a specific VLAN: Radius Attribute 64 (Tunnel-Type): Set to VLAN (value 13) Radius Attribute 65 (Tunnel-Medium-Type): Set to 802 (value 6) Radius Attribute 81 (Tunnel-Private-Group-ID): Specifies the dynamic VLAN ID or VLAN interface name If Allow AAA Override is not checked under the WLAN's Advanced tab, the WLC deliberately ignores these returned RADIUS attributes and places the user onto the WLAN’s default static interface. Enabling it instructs the controller to override the WLAN's default mapping with the VLAN tag supplied by the RADIUS server. ### Why the Other Options Are Incorrect A. Change of Authorization (CoA): Used dynamically to update an existing session's state (such as kicking off posture re-authentication or URL redirection changes), but it does not enable the WLAN to parse and apply initial dynamic VLAN tags returned in standard RADIUS access-accept packets. C. FlexConnect: An AP mode designed for branch deployments to switch traffic locally or centrally, independent of dynamic policy overrides. * D. CWA redirect ACL: An access control list used specifically during Central Web Authentication to intercept HTTP/HTTPS traffic and redirect clients to the guest/login portal; it does not assign VLAN tags.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.