Cisco 300-110 - Designing Cisco Wireless Networks (300-110 WLSD) v1.2

In Cisco ' s AP controller preference hierarchy, each AP can be configured with a primary, secondary, and tertiary controller designation. The AP will attempt to join controllers in this exact order: primary first, secondary second, and tertiary third. When no controllers from the preference list are available, the AP may fall back to any reachable controller through standard CAPWAP discovery. In this hospital deployment, the service/development controller must be the controller of last resort — it should only receive AP associations when all other options are exhausted. Configuring the service/dev controller as the tertiary controller in the APs ' preference configuration ensures exactly this behavior: APs will attempt the SSO pair (primary) first, then the third production WLC joined via mobility tunnel (secondary), and only then the service/dev controller (tertiary). This prevents development traffic from disrupting production service, and ensures production APs do not inadvertently join the service environment during partial outages. Configuring it as primary (Option A) or secondary (Option C) would allow APs to join the service controller before exhausting production options. AP failover priority (Option D) governs which APs are processed during controller recovery, not the controller preference order during join. Reference: WLSD Study Guide — AP Controller Preference Configuration, Primary/Secondary/Tertiary WLC Assignment, Hospital WLAN High Availability Design.

When configuring high availability on a Cisco access point, the AP can be configured with a maximum of three controllers: a primary controller, a secondary controller, and a tertiary controller. This three-tier hierarchy defines the failover order — the AP first attempts to join its primary controller, then the secondary if the primary is unavailable, and finally the tertiary if both the primary and secondary are unreachable. After exhausting all three configured options, the AP enters a discovery process to find any available controller. This three-controller configuration (primary, secondary, tertiary) allows network engineers to implement N+1 redundancy where critical APs can be directed to specific backup controllers in a deliberate sequence. Limiting the configuration to only 2 controllers (as stated in Option B which would be incorrect) would reduce redundancy options for environments with geographically distributed controllers requiring specific failover paths. Reference: WLSD Study Guide — AP High Availability Configuration, Primary/Secondary/Tertiary Controller Assignment, AP Failover Design.

In Cisco ' s guest anchor WLC deployment model, multiple anchor controllers can be configured in a DMZ to provide redundancy for guest WLAN traffic. The anchor priority value determines which anchor controller is preferred for establishing the guest mobility tunnel from the foreign WLC. Cisco ' s anchor priority system assigns the highest preference to the lowest numerical priority value. Priority 1 is the highest priority, meaning the foreign WLC will prefer Anchor1 when establishing the CAPWAP mobility tunnel for anchoring guest client traffic. Priority 2 would be assigned to Anchor2, and Priority 3 to Anchor3, creating a deterministic failover hierarchy. If Anchor1 becomes unreachable, the foreign controller automatically falls over to Anchor2, then to Anchor3. Priority 0 is not a valid anchor priority value in the Cisco WLC configuration. This design pattern is critical for enterprise guest deployments where DMZ anchor redundancy must be maintained without manual intervention. Reference: WLSD Study Guide — Guest Wireless Architecture, Anchor WLC Configuration, Mobility and DMZ Design.

This design scenario requires careful interpretation of the SSO pair function and AP priority semantics. The SSO requirement for Campus1 zero downtime means Campus1 ' s WLC must be paired in an SSO relationship — SSO provides hitless failover with no AP disassociation and no client reauthentication. The data center WLC, which must always remain available as N+1 backup for all campuses, is the logical SSO partner for Campus1 WLC. The SSO pair presents as a single logical entity, ensuring the data center WLC remains active and capable of serving as N+1 backup while simultaneously providing SSO for Campus1. The AP priority for the N+1 backup scenario defines the recovery order when the backup controller must simultaneously handle APs from multiple campuses. In Cisco WLC AP failover priority, priority 1 is Critical (highest). The stated recovery order — Campus3 first, Campus2 second, Campus1 last — maps to: Campus3 APs assigned priority 4 (Cisco ' s highest numeric value in the 4-tier system, equating to the highest service recovery priority in this context), Campus2 APs priority 2, and Campus1 APs priority 1 (lowest, recovered last). Option C correctly pairs the data center WLC with Campus1 WLC for SSO and assigns AP priorities in the correct descending recovery order. Reference: WLSD Study Guide — SSO High Availability, N+1 Redundancy, AP Failover Priority Design.

To optimize roaming in a wireless network with multiple controllers, it is essential to use the same WLAN name (SSID) across all controllers. When SSIDs differ between controllers, clients perceive them as different networks and must perform a full re-association and re-authentication when roaming between APs managed by different controllers. This causes a roaming disruption equivalent to connecting to an entirely new network. By using identical SSID names on both controllers, clients can seamlessly roam between APs on different controllers within the same mobility group — the controllers exchange client state information via the mobility tunnel, enabling seamless handoff. In the scenario described, ' Copr-NET390595865WLC-1 ' and ' Copr-NET6837l638WLC-2 ' are different SSIDs, meaning clients cannot roam transparently between them. Making both controllers broadcast the same SSID name (and using a mobility group to connect the controllers) resolves this. Reference: WLSD Study Guide — SSID Consistency Across Controllers, Inter-Controller Roaming, Mobility Group Configuration.

In Cisco mesh networking architecture, access points are classified into two primary roles: Root Access Points (RAP) and Mesh Access Points (MAP). A RAP is an access point that maintains a wired Ethernet backhaul connection back to the network infrastructure, while a MAP operates wirelessly, relying on mesh backlinks to upstream RAPs. When an engineer needs to change an AP mode — such as switching to bridge mode to extend the mesh — the AP role must first be defined correctly. The AP must be designated as a RAP before any mode-level configuration changes are applied. This sequencing is critical because the AP role defines the fundamental backhaul path; changing the mode without first establishing the role results in misconfiguration and potential connectivity loss. The RAP communicates directly with the wired infrastructure via its Ethernet port, making it the gateway for all downstream MAPs in the mesh topology. Options A (monitor), C (bridge), and D (local) refer to AP modes, not roles, and cannot be configured until the role is properly defined. Reference: WLSD Study Guide — Mesh Networking Fundamentals, Outdoor Wireless Design, AP Role and Mode Configuration.

Flex+Bridge mode is a specialized AP operating mode that combines two distinct Cisco wireless capabilities: FlexConnect (for local switching of client data traffic and central authentication via the WLC) and Bridge/Mesh mode (enabling wireless backhaul when no wired Ethernet uplink is available). In a branch environment without wired backhaul, a standard FlexConnect AP (Option D) cannot operate because FlexConnect still requires an Ethernet connection for its control plane. Bridge mode alone provides mesh backhaul but does not support the local switching with central authentication model required here. MAP (Option A) is a Mesh Access Point role for wireless backhaul, and RAP (Option C) is a Root Access Point with a wired connection — neither meets the no-wired-backhaul requirement with local switching. Flex+Bridge uniquely satisfies both requirements: the Flex component allows locally switched VLANs to be bridged directly to the access layer without traversing the WAN, while the Bridge component enables the AP to use a wireless mesh link for its backhaul uplink. Central authentication is maintained via the CAPWAP control tunnel over the mesh link. Reference: WLSD Study Guide — FlexConnect Design, Mesh Networking, Flex+Bridge Mode Configuration and Use Cases.

The command ' debug mobility handoff enable ' is used to validate the mobility control packets between Wireless LAN Controllers (WLCs). This command enables debugging of the handoff process, which is critical for ensuring seamless client roaming between controllers. When WLCs are separated by firewalls, it is essential to confirm that mobility control packets can traverse these firewalls without being dropped or rejected. The ' debug mobility handoff enable ' command allows network administrators to monitor the handoff process in real time and identify whether mobility PDUs are being exchanged successfully. If mobility control packets are being blocked by the firewall, this debug output will show failures in the handoff sequence. This command directly validates bidirectional mobility traffic flow, making it the correct troubleshooting tool for the scenario described. Options A and D are not valid Cisco WLC commands. Option C enables configuration-level mobility debugging but does not specifically validate handoff packet flow. Reference: WLSD Study Guide — Mobility Troubleshooting, Debug Commands, Inter-Controller Roaming Validation.