On Catalyst 9800 controllers each WLAN is tied to a policy profile, which in turn is bound to a Layer-3 interface (SVI). Creating a dedicated guest SVI with network 10.20.30.0/24 and mapping that interface to the guest policy profile guarantees that DHCP offers originate only from that pool and keeps traffic logically separated from corporate VLANs, allowing the required 200+ clients while maintaining isolation.

A. Shared pool can still hand out corporate subnet addresses; policy tag alone does not create VLAN separation.

C. DHCP option 43 is used for AP discovery, not client address allocation; shared pool again breaks isolation.

D. Static addressing is unmanageable for 200+ guests and does not enforce VLAN separation.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, 17.3, “Creating a VLAN Interface and Mapping to Policy Profile”, steps 1–5.

2. Cisco Validated Design – Guest Access on Catalyst 9800 (CVD-9800-GUEST), pp. 14-17.