300-430 ENWLSI Lab Guide 2026: Now 300-120 WLSI
The exam number changed in March 2026. The lab did not: you still cannot virtualise an access point, and that one fact shapes everything.
- 300-430Exam
- 90 minTime
- $300 / $400Fee
- 8Domains
- CML-Personal + one APCheapest lab
- 16 GB hostRAM needed
Table of Contents
The minimum lab
Start with the news, because it changes what you should be booking. Cisco split wireless out of CCNP Enterprise into dedicated CCNP Wireless and CCIE Wireless tracks, first testable 19 March 2026, and this exam was renumbered to 300-120 WLSI, retitled Implementing Cisco Wireless Advanced Solutions. The eight domains and their weights carried over unchanged, so everything below still applies - but if you are booking a seat now, check which number your track actually requires. The lab story is unchanged too, and it has one hard edge: there is no virtual access point.
The switch is the centre of this diagram, not the controller: it trunks the wireless management VLAN and it is where a real access point plugs in. Cisco states plainly that CML has no images for access points or wireless clients, so the AP and the client sit outside the emulator. Two APs is the honest minimum if you want to practise roaming or FlexConnect properly - one AP gets you joined and configured, and no further.
Where to build it
A virtual controller is easy. A virtual access point does not exist. Every platform decision here follows from that.
| Platform | Good enough? | Cost | What decides it |
|---|---|---|---|
| CML-Personal + one real AP | Yes | $199/yr + used AP | The only setup that reaches the whole blueprint. The Catalyst 9800-CL runs virtually; the AP cannot. |
| CML-Personal alone | Config only | $199/yr, 20 nodes | Good for controller configuration, WLAN and policy profiles, and security settings. Nothing that requires a client to associate. |
| CML-Free | No | $0, 5 nodes | The 9800-CL is not on the free ISO, and the node budget would not hold the topology anyway. |
| Real WLC + two APs | Yes | Used gear | The traditional answer and still the best one if you can find the hardware. Two APs is where roaming becomes practisable. |
| Cisco DevNet Sandbox | Worth checking | $0 | Free reservable environments come and go. Worth a look before buying anything. |
One caution about a shortcut you will see suggested: the wireless access-point node that appears in recent CML releases is a Linux host running hostapd, not a Cisco AP. It is useful for producing a wireless client, and it is not a substitute for a real AP joining a controller.
Images and horsepower
The controller is the only heavy node, and its memory depends on a choice you make when you deploy it.
| Component | What it is | Where it comes from |
|---|---|---|
| Catalyst 9800-CL | The wireless LAN controller | CML supplemental image set. Default Ultra-Low profile is 2 vCPU and 6 GB |
| IOL-L2 | The access switch that trunks management and carries the AP | CML reference platform, 1 GB |
| IOL | Layer 3 gateway and DHCP for the wireless clients | CML reference platform, 1 GB |
| Ubuntu Linux | A RADIUS stand-in and a browser for the guest portal | Bundled, about 2 GB |
| A real access point | The part that cannot be virtualised | Used hardware. Two if you want roaming |
Roughly 10 to 12 GB of node memory in the default controller profile, so a 16 GB host covers FlexConnect work. Note that the default Ultra-Low profile does not support local-mode access points, where client traffic tunnels back to the controller - if you need local mode, the controller wants 4 vCPU and 8 GB, and a 32 GB host becomes sensible.
The build list
Work top to bottom. Each step is a thing you build and then break on purpose, and each one is tagged with the blueprint domain it covers, so by the end you have touched the parts of the syllabus a lab can reach.
Get the controller up and one AP joinedDevice Hardening 10%
Trunk the management VLAN, get the AP a DHCP address and watch it join. Then harden it: device access control with RADIUS and TACACS+, access point authentication, control-plane ACLs on the controller. That whole domain lives right here at the start.
Convert the AP to FlexConnect and break the WANFlexConnect 15%
Switch to FlexConnect, set local switching, then disconnect the controller and see which capabilities survive. Standalone behaviour is the interesting half of this domain.
Wire up 802.1X against RADIUSSecurity 20%
The heaviest domain at 20%. Get a client authenticating with 802.1X, then add identity-based policy so different users land on different VLANs. Client profiling is examinable on both the controller and ISE.
Build a guest WLAN with a portalSecurity 20%
Web authentication and a sponsor or guest portal. It is fiddly, it is heavily examined, and it is entirely doable with one AP.
Map QoS from wired to wirelessQoS 10%
Apply a QoS scheme end to end and confirm the marking survives the CAPWAP tunnel. Add AVC and Fastlane on the controller while you are there.
Turn on multicast and watch it misbehaveMulticast 10%
Enable multicast on a WLAN, then try mDNS and Multicast Direct. Wireless multicast behaving badly is the point of the domain, and seeing it once is worth more than reading it twice.
What you can and cannot lab
Cisco publishes the domain weightings but not the number of items or the passing score, so treat the percentages as how the paper is built rather than as a target. The column that matters here is the last one.
| Domain | Weight | Labbable | Notes |
|---|---|---|---|
| FlexConnect | 15% | Partly | TODO |
| QoS on a Wireless Network | 10% | Partly | TODO |
| Multicast | 10% | Partly | TODO |
| Location Services | 10% | Partly | TODO |
| Advanced Location Services | 10% | Partly | TODO |
| Security for Wireless Client Connectivity | 20% | Partly | TODO |
| Monitoring | 15% | Partly | TODO |
| Device Hardening | 10% | Partly | TODO |
The walls you will hit
This exam has the hardest physical wall in the batch, and Cisco says so itself.
Cannot be labbed at home
- There is no virtual access point and no virtual wireless client. Cisco states this directly. Everything downstream of the AP - join troubleshooting, client onboarding, roaming - needs hardware.
- Roaming needs two APs. One AP gets you a working WLAN. It cannot show you a client moving between them, which is a large part of what the exam is about.
- RF behaviour is not emulable. Interference, coverage, Hyperlocation accuracy and anything involving real radio conditions have no software equivalent.
- Controller high availability is not supported virtually. The HA features of the physical Catalyst 9800 controllers do not carry over to the cloud image.
- Location services need infrastructure you will not have. CMX and Cisco Spaces are 20% of the paper across two domains and are realistically read-and-diagram topics for a home lab.
That leaves an unusual split: roughly half this blueprint labs well with one real access point, and the other half - location services, advanced location services, and the roaming parts of security - is documentation and question practice. Plan for that division rather than fighting it, and check which exam number your track requires before you book.
A lab proves you can build it. Questions prove you can pass.
The blueprint is only half the exam — the other half is answering under a clock. Start with the free question sets, then $5.99 unlocks the full 300-430 ENWLSI bank.
Free 300-430 ENWLSI practice test300-430 ENWLSI exam pageFAQ
Is 300-430 ENWLSI still a valid exam?
Cisco split wireless out of CCNP Enterprise into dedicated CCNP Wireless and CCIE Wireless tracks, first testable 19 March 2026, and renumbered this content to 300-120 WLSI, retitled Implementing Cisco Wireless Advanced Solutions. The eight domains and weights carried across unchanged. Check which number your track requires before booking - and note the successor is listed at a higher fee.
Can I lab wireless without buying an access point?
Only partly. Cisco states that its modelling software has no images for access points or wireless clients, so a virtual controller lets you configure WLANs, policies and security settings but never lets a client associate. One used AP unlocks most of the blueprint; two unlock roaming.
How much RAM does a Catalyst 9800-CL need?
The default Ultra-Low profile is 2 vCPU and 6 GB, which is enough for FlexConnect work on a 16 GB host. Local-mode access points, where client traffic tunnels back to the controller, are not supported on that profile and need 4 vCPU and 8 GB.
What is the passing score for this exam?
Cisco publishes neither a passing score nor an item count for it, as with every Cisco exam. Cut scores are set by statistical analysis and can change without notice.
Sources
Exam facts come from Cisco. Lab guidance is marked as official or as practitioner consensus where the two differ:
- https://learningcontent.cisco.com/documents/marketing/exam-topics/300-430-ENWLSI-v1.1.pdf
- https://learningnetwork.cisco.com/s/wireless-certifications
- https://developer.cisco.com/docs/modeling-labs/
- https://www.cisco.com/site/us/en/learn/training-certifications/exams/policies.html
Checked September 5, 2026. Cisco revises exam topics and changes image licensing without notice — confirm before you spend anything.