A CPU Access Control List (ACL) on a Cisco Wireless LAN Controller (WLC) is designed to protect the controller's central processing unit by filtering traffic destined for the controller itself. This includes management traffic (such as SSH, HTTPS, Telnet, SNMP) and control plane traffic. Such traffic can originate from devices on the wired network (e.g., a network administrator's workstation, a RADIUS server, or Access Points) as well as from wireless clients (e.g., for authentication or management purposes). Therefore, enabling a CPU ACL affects both wired and wireless traffic that is addressed to the WLC's IP addresses.

A. wireless traffic only: This is incorrect because CPU ACLs also filter traffic from wired sources, such as management stations or network infrastructure devices communicating with the controller.

B. wired traffic only: This is incorrect because CPU ACLs also filter traffic originating from wireless clients, particularly traffic that needs to be processed directly by the controller.

C. VPN traffic: This is too specific and incomplete. While some VPN traffic terminating on the WLC would be subject to the CPU ACL, the ACL's scope is much broader.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: In the "Configuring ACLs" chapter

the section "CPU ACLs" states

"CPU ACLs are configured to prevent or allow certain traffic from either the wired or wireless clients from reaching the controller CPU." This explicitly confirms the ACL applies to both traffic types.

2. Cisco AireOS 8.10 - CPU ACLs Configuration Example: The introduction of this document states

"CPU ACLs are an ACL that is applied to traffic that is destined for the controller's CPU. This can be traffic from wireless clients or from the wired side." This directly supports that both wired and wireless traffic are affected.

3. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

IOS-XE Amsterdam 17.3.x: While the question's menu path points to AireOS

the principle is identical on modern controllers. In the "System Management Guide > Configuring CPU ACLs" section

it describes applying ACLs to the control plane

which processes traffic from both wired and wireless sources destined for the controller.