MENU
A community bank has three campus locations and one HQ with the data center. Each campus has four Cisco Catalyst 9120 APs. Poor WAN uplinks cause impacted connectivity back to HQ, and each campus is planned to have its own EWC controller based on C9120 AP to keep traffic local. Guest WLAN will be routed locally. Employee WLAN must be authenticated 802.1x PEAP via HQ ISE but can pass traffic locally once authenticated. HQ WLC will be the primary backup WLC for each WLC. Which design approach should the consulting engineer take?
This community bank design scenario requires precise alignment of EWC deployment scale, AAA integration, and traffic routing decisions with the stated constraints. With four APs per campus and a goal of local traffic handling, converting a single C9120 to EWC mode is optimal --- converting two APs to EWC (Options B and C) on a four-AP campus wastes 50% of campus AP infrastructure for controller functions rather than client service. The single EWC AP serves as the active local controller for the remaining three client-serving APs. The HQ WLC set as N+1 backup ensures that if the branch EWC fails, the remaining APs fall back to the centralized controller. For the guest WLAN, local web authentication on the guest VLAN provides the locally routed guest access requirement without requiring WAN connectivity to HQ. For the employee WLAN, adding the HQ ISE AAA server to the EWC's RADIUS configuration enables 802.1x PEAP authentication to traverse the WAN to ISE at the time of client association. Once authenticated, traffic is locally switched --- satisfying both the central authentication and local traffic routing requirements simultaneously. Option D's use of guest anchor for the employee WLAN is architecturally incorrect and would route traffic through HQ rather than locally. Reference: WLSD Study Guide --- EWC Design, N+1 Redundancy, AAA Integration for Branch WLANs, Local Web Authentication.