Which Commands Configure AAA for Central Web Authentication on a 9800 WLC?
An engineer must configure AAA on a Cisco 9800 WLC for central web authentication. Which two commands are needed to accomplish this task? (Choose two.)
Community Votes
100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question evaluates whether candidates understand that CWA relies on RADIUS Dynamic Authorization (CoA) for post-authentication policy enforcement, rather than traditional WLAN-level AAA override settings.
This question tests the exact AAA commands required to enable Central Web Authentication (CWA) on a Cisco Catalyst 9800 WLC, highlighting the dependency on RADIUS Dynamic Authorization. Community consensus strongly supports options A and D, confirming that global dynamic author activation and RADIUS client key configuration are mandatory.
Candidates frequently select AE, incorrectly applying legacy WLAN AAA override commands instead of recognizing that CWA requires global RADIUS dynamic authorization configuration on the IOS-XE-based WLC.
Community Discussion (13 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Correct Answer Explanation
Central Web Authentication (CWA) on the Cisco Catalyst 9800 WLC requires seamless communication between the wireless controller and the RADIUS/ISE server to enforce policies after a user successfully authenticates via the captive portal. To enable this, the WLC must support RADIUS Dynamic Authorization (Change of Authorization or CoA).Option A (aaa server radius dynamic-author) is the first mandatory step. It globally enables the dynamic authorization feature on the IOS-XE-based WLC and transitions the CLI into the local server dynamic authorization configuration mode. Once in this mode, Option D (client 10.10.10.12 server-key 0 SECRET) correctly defines the remote RADIUS server IP address and the shared secret used to secure CoA messages between the WLC and the authentication server. Together, these two commands establish the necessary pathway for ISE to dynamically push VLAN assignments, ACLs, or session timeouts to the WLC.
Why Other Options Are Incorrect
- Option B & E reference
config wlan aaa-override, which is either legacy AireOS syntax or misapplied in this context. The 9800 WLC handles CWA through global AAA and RADIUS CoA mechanisms, not WLAN-level override flags. Additionally, disabling override (B) would actually break CWA functionality. - Option C configures a RADIUS accounting server. While accounting is useful for auditing and billing, it plays no role in the authentication flow or dynamic policy assignment required for CWA.
Key Technical Concept
CWA fundamentally depends on RADIUS Dynamic Authorization. Without enablingaaa server radius dynamic-author and registering the RADIUS client with a valid server-key, the WLC cannot receive or process CoA packets from ISE, rendering centralized policy enforcement impossible.Community Insights & References
Multiple candidates confirmed AD by cross-referencing official Cisco configuration guides. As noted in the community, the CLI context shift toDevice(config-locsvr-da-radius)# in Option D directly follows the execution of Option A, making them a syntactically and functionally linked pair. Official Reference
Exam Strategy
When answering 9800 WLC AAA questions, always verify whether the scenario involves Central Web Authentication or Dynamic Authorization. If so, immediately look for aaa server radius dynamic-author paired with a client statement containing the RADIUS server IP and shared key. Disregard legacy AireOS-style WLAN override commands and accounting configurations, as they are common distractors in IOS-XE wireless exams.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →