Locally (control plane) generated traffic goes from control plane directly to "tx-ring". That is different from processing/forwarding of Transit traffic. Please see the platform's "packet journey" session of Cisco Live or other documentation to see the different internal path & processing for:
Transit, forus, exception, locally generated.

Path Selection Attributes: Weight > Local Preference > Originate > AS Path > Origin > MED > External > IGP Cost > eBGP Peering > Router ID

Deploying WPA2-Enterprise requires a RADIUS server, which handles the task of authenticating network users access. The actual authentication process is based on the 802.1X policy and comes in several different systems labelled EAP. Because each device is authenticated before it connects, a personal, encrypted tunnel is effectively created between the device and the network.
Reference: https://www.securew2.com/solutions/wpa2-enterprise-and-802-1x-simplified/

https://www.cisco.com/c/en/us/support/docs/ip/ip-multicast/16450-mcastguide0.html

SUMMARY STEPS
Perform this task to create a password security policy and to apply the policy to a specific user profile.
enable
configure terminal
aaa new-model
aaa common-criteria policy policy-name
char-changes number
max-length number
min-length number
numeric-count number
special-case number
exit
username username common-criteria-policy policy-name password password
end