What is the major difference between named ACLs and dACLs?
- dACLs are configured on Cisco ISE; named ACLs can be configured on Cisco ISE or locally on the WLC.
- dACLs can be configured locally on the WLC or on Cisco ISE; named ACLs are configured locally on the WLC.
- dACLs are configured on Cisco ISE; named ACLs are configured locally on the WLC.
- dACLs are configured locally on the WLC; named ACLs are configured on Cisco ISE.
Explanation: The major difference between these two types of access control lists lies in where they are defined and how they are delivered to the network device:
- Downloadable ACLs (dACLs): These are configured centrally on Cisco ISE. During the authentication and authorization process, the entire ACL is "pushed down" or downloaded from the RADIUS server to the switch. The switch then applies these attributes to the specific port for the duration of the user session.
- Named ACLs: These are primarily used for wireless users and are configured locally on the Wireless LAN Controller (WLC). In this scenario, Cisco ISE does not send the actual ACL content; instead, it simply informs the WLC which locally stored ACL name should be applied to that specific user session.
While both provide differentiated access based on user identity, dACLs are dynamic and centralized, whereas named ACLs rely on pre-existing local configurations on the network access device.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
