In Ekahau Site Survey, passive mode involves listening to beacon frames and probe responses from deployed APs without the survey laptop actively associating to any SSID. This is significantly faster than active mode because no association, DHCP, or throughput test overhead is introduced — the surveyor simply walks the floor while Ekahau passively captures signal strength data from all visible APs simultaneously. Using two wireless adapters in passive mode provides a critical speed advantage: one adapter scans 2.4 GHz channels while the second adapter simultaneously scans 5 GHz channels. Without dual adapters, a single adapter must time-multiplex between bands, reducing the sample rate per band and either slowing the survey walk or producing sparser data. Active mode (Options B and C) is used when throughput measurements are required for specific application validation such as voice or video, but it is inherently slower due to association overhead and sequential testing. The combination of passive scanning and dual adapter configuration delivers the highest possible data collection rate per unit of walk time. Reference: WLSD Study Guide — Ekahau Site Survey Modes, Passive vs. Active Survey Methodology, Multi-Adapter Survey Configuration.

IEEE 802.11v BSS Transition Management is the standard that enables the network (via the AP) to actively provide roaming recommendations and suggestions to associated clients. When enabled on a SSID, the AP can send BSS Transition Management Request frames to clients, informing them of preferred target APs ranked by signal quality, load, and channel conditions. Critically, BSS Transition Management is a voluntary mechanism — clients that support 802.11v can act on the AP ' s recommendation, while clients that do not support 802.11v simply ignore the BSS Transition Request frames and continue operating normally. This selective applicability directly satisfies the requirement that non-VoWLAN clients must not be impacted. 802.11k (Option A) enables clients to build neighbor lists through measurement reports — this is a client-initiated process, not an AP-to-client recommendation. CCKM (Option B) is a Cisco proprietary fast roaming mechanism for legacy clients, unrelated to roaming guidance. 802.11r (Option D) accelerates the re-association handshake during roaming but does not provide proactive roaming recommendations. Reference: WLSD Study Guide — VoWLAN Design, 802.11v BSS Transition Management, Roaming Optimization Protocols.

Enabling AP fallback globally on the WLC allows access points to reconnect to their primary controller after they have connected to a secondary controller due to the primary being offline. This is the exact behavior described in the scenario — APs successfully fail over to the secondary WLC but do not return to the primary WLC when it recovers. AP Fallback is a WLC-level setting that monitors the availability of each AP ' s configured primary controller and initiates a reconnection when the primary becomes reachable again. Without AP Fallback enabled, APs remain on whatever controller they most recently joined — in this case, the secondary — even after the primary recovers. The CAPWAP AP Controller IP Address command (Option A) permanently changes the primary controller configuration on the AP, which is not the intended solution — the AP already has the correct primary configured. DHCP Option 43 (Option B) is used for initial AP discovery, not fallback. AP Failover Priority (Option D) controls which APs are processed first during a failover event, not whether APs return to their primary controller. Reference: WLSD Study Guide — AP Fallback Configuration, N+1 Redundancy Recovery, Controller Primary/Secondary Hierarchy.

When eping (EoIP ping) fails between two Cisco Wireless LAN Controllers, it indicates that the data path of the mobility tunnel is blocked. In Cisco AireOS wireless networks, the mobility data path uses IP Protocol 97 (EtherIP — Ethernet-over-IP encapsulation) for tunneling client traffic between the anchor and foreign controllers. This is distinct from the control path, which uses UDP port 16666. When the mobility data path (IP Protocol 97) is blocked by a firewall or ACL between the two controllers ' networks, eping will fail because eping specifically tests the EoIP data encapsulation path. After a power cut, when clients disconnect and attempt to roam between APs on different controllers, the mobility tunnel must be operational for session continuity. If IP Protocol 97 is blocked, the mobility data plane cannot function, causing client disconnections during inter-controller roaming events. The other IP protocols listed (67, 77, 87) are not used for Cisco WLC mobility tunneling. Reference: WLSD Study Guide — Mobility Tunnel Data Path, IP Protocol 97 (EtherIP), eping Command and Troubleshooting.

The Cisco Catalyst 9800 IOS XE WLC uses a tag-based configuration architecture. Three primary tag types are used: site tags, policy tags, and RF tags. The site tag associates an AP with its operational context and contains two specific profile references: the AP join profile (defining AP-level parameters such as NTP, syslog, SSH, LED behavior, and CAPWAP timers) and the flex profile (defining FlexConnect-specific parameters including locally switched VLANs, split tunneling, local authentication settings, and VLAN-ACL mappings). The flex profile within the site tag enables the AP to operate in FlexConnect mode with locally configured switching behavior when WLC connectivity is lost. QoS (Option A) policies are applied at the policy tag level within WLAN policies. NAT (Option B) is not a native profile type in the 9800 tag architecture. VLAN (Option D) configurations are defined within the flex profile or policy profile and are not standalone profile types at the tag level. Understanding the three-tag model is essential for designing and troubleshooting 9800-based deployments. Reference: WLSD Study Guide — Catalyst 9800 Configuration Model, Site Tag Architecture, Flex Profile and AP Join Profile.

In a Cisco Catalyst 9800 SSO deployment using Link Aggregation Group (LAG) for network interface redundancy, the SSO pair — WLC1 (active) and WLC2 (standby) — must both have their physical interfaces connected to the network infrastructure as part of the LAG bundle. LAG on the 9800 in an SSO configuration is implemented as a multi-chassis LAG across both the active and standby controllers. This means both WLC1 and WLC2 contribute physical member links to the port channel, and the connected switches must have LACP or PAgP bundle members from both controllers in the same port channel group. When an SSO failover occurs — WLC1 fails and WLC2 takes over as active — the LAG remains operational because WLC2 ' s physical links are already established members of the bundle and continue forwarding traffic without any link renegotiation. If only WLC1 had LAG connectivity and WLC2 had independent links, an SSO failover would cause a LAG topology change requiring re-convergence, introducing downtime. WLC3 is a separate N+1 backup controller joined via a mobility tunnel — not part of the SSO pair and its LAG configuration is independent. Reference: WLSD Study Guide — Catalyst 9800 SSO with LAG, Multi-Chassis Link Aggregation, High Availability Network Redundancy Design.

On the Cisco Catalyst 9800 IOS XE WLC platform, the tag-based configuration model uses site tags to associate APs with specific profiles including a flex profile and an AP join profile. The site tag is a fundamental binding element — when any component of a site tag is modified, including renaming the flex profile associated with that tag, the WLC treats this as a material configuration change requiring the AP to re-evaluate its operational parameters. Specifically, the AP must disconnect its existing DTLS (Datagram Transport Layer Security) control plane tunnel to the WLC and re-establish it. This DTLS session disconnect and rejoin cycle is equivalent to a full AP rejoin: CAPWAP discovery, DTLS handshake, join request, configuration download, and image verification. Client service is interrupted on the affected AP during this process. Firmware updates (Option A) occur via a separate image download process. Temporary SSID disable (Option B) is not a defined behavior for profile name changes. Switching to a backup controller (Option C) requires AP failover conditions, not configuration changes. Understanding the disruptive nature of site tag modifications is essential for change management in production 9800 deployments. Reference: WLSD Study Guide — Catalyst 9800 Tag-Based Configuration Model, Site Tag Architecture, Flex Profile and AP Join Profile Management.

In an anchored WLAN deployment, client traffic is encapsulated within CAPWAP mobility tunnels between the foreign WLC (where the AP joins) and the anchor WLC (in the DMZ or designated network segment). This tunneling adds encapsulation overhead — CAPWAP/mobility tunnel headers consume a portion of the available MTU on the transport path. When video streaming clients generate large TCP segments, these segments may exceed the effective MTU of the mobility tunnel path, causing IP fragmentation at the WLC or along the path to the anchor. Fragmentation significantly degrades throughput and increases CPU overhead for high-volume video traffic. The correct solution is TCP MSS Clamping — reducing the Maximum Segment Size value advertised in TCP SYN packets so that TCP endpoints negotiate a segment size remaining below the fragmentation threshold. The Cisco 9800 WLC supports TCP MSS adjustment, which intercepts TCP handshake packets and rewrites the MSS option to a value accounting for CAPWAP tunnel overhead. Setting matching MTUs (Option A) does not prevent fragmentation if the effective tunnel MTU is lower than the client segment size. Increasing the MTU (Option B) is often constrained by physical infrastructure. Setting the DF bit (Option D) would cause packets to be dropped rather than fragmented. Reference: WLSD Study Guide — Anchored WLAN Design, CAPWAP Mobility Tunnel MTU, TCP MSS Clamping.