When configuring Local WebAuth on a Cisco WLC per RFC 5737, which virtual IP must be used?

The correct answer is 192.0.2.1. RFC 5737 reserves the 192.0.2.0/24 range (TEST-NET-1) for use in documentation and example code. Cisco WLCs use 192.0.2.1 as the default virtual IP address for Local WebAuth to ensure it does not conflict with any real network addresses in a production environment. This allows the WLC to intercept HTTP/HTTPS traffic from clients before authentication and redirect them to the WebAuth portal without requiring a routable IP address for the portal itself. The other options (172.20.10.1, 192.168.0.1, 1.1.1.1) are all commonly used or routable IP addresses that could cause conflicts if used as a virtual IP for this purpose.