A client connecting to an 802.1X SSID configured in tunnel mode with default AP-group settings sends Access-Accept to the AP through which tunnel after the RADIUS server responds?

A client connecting to an 802.1X SSID configured in tunnel mode with default AP-group settings sends Access-Accept to the AP through which tunnel after the RADIUS server responds?

• A. IPsec tunnel
• B. Split tunnel
• C. GRE tunnel
• D. PAR tunnel

Answer: (C)

In tunnel mode, the AP forwards authentication results and user traffic to the central enforcement point through a dedicated tunnel rather than handling everything locally. When the RADIUS server responds with Access-Accept, that response is carried back to the AP over a GRE tunnel. GRE provides lightweight encapsulation to transport the control-plane messages between the AP and the central device, enabling the AP to establish the authenticated session and start tunneling the user’s traffic through the network. Other tunnel types are used for different purposes or security contexts, but for this path in tunnel mode with default AP-group settings, GRE is the mechanism used.

In tunnel mode, the AP forwards authentication results and user traffic to the central enforcement point through a dedicated tunnel rather than handling everything locally. When the RADIUS server responds with Access-Accept, that response is carried back to the AP over a GRE tunnel. GRE provides lightweight encapsulation to transport the control-plane messages between the AP and the central device, enabling the AP to establish the authenticated session and start tunneling the user’s traffic through the network. Other tunnel types are used for different purposes or security contexts, but for this path in tunnel mode with default AP-group settings, GRE is the mechanism used.