An engineer must implement Cisco Identity-Based Networking Services at a remote site using ISE to dynamically assign groups of users to specific IP subnets. If the subnet assigned to a client is available at the remote site, then traffic must be offloaded locally, and subnets are unavailable at the remote site must be tunneled back to the WLC. Which feature meets these requirements?

The scenario requires a solution where client traffic is either switched locally at a remote site or tunneled to the central WLC, with the decision based on the VLAN assigned by ISE. This functionality is explicitly provided by the VLAN-based central switching feature within a FlexConnect architecture. This feature allows an administrator to define which VLANs are tunneled (centrally switched). When a client associates, and ISE assigns it to a VLAN, the FlexConnect AP checks its configuration. If the assigned VLAN is not on the central switching list, its traffic is switched locally. Otherwise, it is tunneled to the WLC, perfectly matching the requirements.

A. learn client IP address: This is a sub-feature of FlexConnect local switching where the WLC learns a client's IP address from the AP, not the mechanism that determines the switching path.
B. FlexConnect local authentication: This feature provides authentication services at the remote site during a WAN outage, which is unrelated to dynamically selecting a traffic switching path.
D. central DHCP processing: This defines where DHCP services are handled (at the WLC), not how client data traffic is switched (locally or centrally) based on its assigned VLAN.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, Cisco IOS XE Cupertino 17.9.x: In the "FlexConnect" chapter, the section "FlexConnect - VLAN Central Switching" states, "FlexConnect - VLAN Central Switching feature enables you to control the switching path of VLANs (that is, local or central) on a FlexConnect AP. You can specify the VLANs that you want to be centrally switched. The VLANs that are not specified as centrally switched are locally switched."

2. FlexConnect Deployment Guide: In the section "VLAN-based Central Switching," it details the process: "When a client connects to a centrally switched VLAN, its traffic is tunneled to the controller. When a client connects to a locally switched VLAN, its traffic is switched locally at the AP. This decision is based on the VLAN ID assigned by the RADIUS server (ISE)." This directly aligns with the question's scenario involving ISE.

3. Cisco Identity-Based Networking Services (IBNS) 2.0 Deployment Guide: The guide explains how ISE provides authorization results, including VLAN assignment. In a FlexConnect context, it notes, "The access point then determines whether the VLAN is configured for local switching or central switching... If the VLAN is not configured for local switching... its traffic is tunneled back to the WLC." This confirms the interaction between ISE and the FlexConnect feature.