topic CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile in Wireless

CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Jordan M — Fri, 17 Apr 2026 20:56:58 GMT

Hey all,

We have 9800 WLC running IOS XE 17.9.3 and a few models of AP's ranging from 9115's to 9124s, 9164s, etc.

We use flexconnect everywhere and all traffic is switch on the local LAN at each location. No Local mode/central switching in our environment (with the exception of some central authentication for 802.1x on a few ssid's).

My question is this:
I can map a WLAN to a VLAN by mapping the WLAN profile to a Policy Profile in a Policy Tag. However, I can also map VLANs in a Flex profile as well. What I'm trying to understand fully is what the flex profile VLAN mapping is actually doing. I've read every cisco doc I can find and it seems like they all just say something along the lines of "Add VLANs in your FLex profile for Flexconnect specific Configurations" but I don't understand what these specific configurations are? Does the Policy profile map the VLAN to the WLAN, or does the Flex profile? Or perhaps both do they both do this, with one taking precedence over the other? Or is the Flex profile simply declaring VLANs?

For example, if I created a WLAN called 'CorpWifi' and a policy profile mapping it to VLAN 5, and then in the Flex Profile I create a VLAN ID of 10 and name it 'CorpWifi', what is the configuration in the flex profile actually doing? What behavior should I be observing?

Thanks in advance?

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

aleabrahao — Fri, 17 Apr 2026 21:07:11 GMT

If you’re not using Flex local auth or per-site overrides, only the Policy Profile matters.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Jordan M — Fri, 17 Apr 2026 21:41:33 GMT

We use flexconnect but central auth. What are you referring to with per-site overrides?

Is the flex profile just declaring vlans/telling the AP what vlans exist?

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Karsten Iwen — Sat, 18 Apr 2026 09:04:53 GMT

Yes:

Flex-Profile: Tells the AP which VLANs (or ACLs) to install, since not every AP might need the same settings.

Policy-Profile: Tells the AP what to do when a device connects. Everything that is assigned needs to be available on the AP. And remember that these settings could also come from the RADIUS server and also need to be available at the AP at the time of connect.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Rich R — Sun, 19 Apr 2026 18:25:15 GMT

@Jordan M the Flex Profile allows you to assign names to the VLANs which can then be used in the policy profiles.
If you only reference the VLAN by ID (VLAN number) in the policy profile then the Flex Profile VLAN definition is not necessary, it will work regardless.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Karsten Iwen — Sun, 19 Apr 2026 18:39:33 GMT

@Rich R Did that change sometime ago? I remember authorization failures when the VLAN number was not in the Flex-Profile.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Rich R — Sun, 19 Apr 2026 23:46:45 GMT

Not that I am aware of @Karsten Iwen we've been using it that way since 17.3

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

MyHomeNWLab — Mon, 20 Apr 2026 00:20:00 GMT

In FlexConnect "Local" Switching, the VLAN configuration in the Flex Profile is essentially equivalent to defining VLANs on the AP itself.
It is similar to the "vlan" command on a WLC, where you define which VLANs the AP is aware of and can use for "Local" Switching.

In the Policy Profile, the VLAN assignment depends on the switching mode:
* For "Central" Switching, the VLAN must be defined on the WLC (similar to the "vlan" configuration on the controller side).
* For "Local" Switching, the VLAN must be defined in the Flex Profile.

For the differences and considerations between configuring VLAN by VLAN "Name" versus VLAN "ID" in a Policy Profile, please refer to the Cisco Catalyst 9800 Best Practices guide (see the section “Use of VLAN 1 in a Policy Profile”).

Cisco Catalyst 9800 Series Configuration Best Practices - Cisco
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#UseofVLAN1inaPolicyProfile

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Karsten Iwen — Mon, 20 Apr 2026 06:45:21 GMT

Thanks @Rich R
Just deleted a TEST-VLAN from the Flex-Profile and as you said, still working. I have to adjust my memories!

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Rich R — Mon, 20 Apr 2026 09:57:49 GMT

Yep we use it that way across literally thousands of sites <smile>

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Rich R — Mon, 20 Apr 2026 10:01:36 GMT

Yuki @MyHomeNWLab - regarding your statement "For "Local" Switching, the VLAN must be defined in the Flex Profile.":
as you'll see from my and Karsten's discussion above - it is not essential if only using VLAN ID, only if using named VLAN.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

MyHomeNWLab — Tue, 21 Apr 2026 12:24:30 GMT

@Rich R Thanks for your comment.

I might be misremembering, so I re-tested it to verify the behavior.
If the VLAN configured in the Policy Profile matches the native VLAN in the Flex Profile, traffic can be forwarded without explicitly defining the VLAN in the Flex Profile. (Local Switching)

[Policy Profile]
VLAN/VLAN Group: 99

[Flex Profile]
Native VLAN: 99

No VLAN 99 defined in the Flex Profile

[WLC's VLAN ("vlan" command]
No VLAN 99 defined on the WLC

~~However, when the VLAN was defined on the WLC but not in the Flex Profile, client traffic could not be forwarded.~~
↑ I made a mistake in my testing. (Last edited: 2026-04-21)

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Karsten Iwen — Tue, 21 Apr 2026 08:55:59 GMT

My Test was basically the same:

The APs are on VLAN 253 which is native on the Switchport.
RADIUS pushes my client to VLAN 251
VLAN 251 is not in the Flex-Profile.

This combination worked. I am on 17.18.2 with 917x APs. (I will update to 17.18.3 soon)

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

MyHomeNWLab — Tue, 21 Apr 2026 12:22:43 GMT

I made a mistake in my testing.😅
I configured an arbitrary VLAN ID (e.g., vlan-id 99) in the Policy Profile, but the corresponding VLAN was not configured on the upstream switch and router, which led to an incorrect test result.

With a VLAN ID (vlan-id) configured in the Policy Profile, traffic could be forwarded even without defining the VLAN in the Flex Profile.
However, when using Dynamic VLAN assignment, the VLAN must be defined in the Flex Profile.
Otherwise, the client remains on the VLAN configured in the Policy Profile. (tested on CW9162 & 17.15.3).

As a related note, as of version 26.1.1 (latest as of April 2026), the maximum number of VLANs in a Flex Profile is 16.

> % node-(1):dbm:wireless:The maximum number of interfaces:16 have been added to the flex-profile.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Chris McCann — Wed, 22 Apr 2026 10:31:27 GMT

Hi Folks,

Hope you can help. Having a nightmare setting up a new guest service. (PurpleX).
Part of their instructions state I should create two policys, the second being a flex policy (which is what we are using). Should I be using this flex policy or at some times using the first policy. I find it odd that they have informed me I need both. Yet as far as I am concerned I should be using flex. Just seems odd.

2nd question, (I am sure there will be more).
Within my new flex policy, should I be using the native vlan or the one I want the SSID to use.

Many thanks, its really beginning to hurt my head.

No doubt I may have more questions.
Regards,

Chris.
PS, At the moment the ssid isnt broadcasting for some reason.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Karsten Iwen — Wed, 22 Apr 2026 12:47:24 GMT

@Chris McCann Please start a new topic for this.

Re: CIsco 9800 WLC Flexconnect Vlan Mapping - Flex vs Policy Profile

Rich R — Wed, 22 Apr 2026 13:41:43 GMT

@Chris McCann agreed with @Karsten Iwen please start a new post because your question is off topic for this post.

I think you might be confusing the flex profile and the policy profile which have completely different functions - flex profile applies to the AP defining various things at AP level, policy profile is assigned with a WLAN to attach the WLAN to a VLAN and other specifics of how the WLAN should be configured.

Your post will need more specific detail - ideally a link to those instructions you're trying to follow.