Losing Local Wireless Capability At Only 1 Site Of 12 When Remote WLC5508 Over IPSEC VPN Becomes Unavailable

[todd.neiert@asg.com]

I have a WLC5508 controller based in India that is servicing all of my EAME/AP sites.  Roughly 15 sites.  The most current site added was a new office also in India with (8) 2802i APs.  That office is connected to the controller site via IPSEC VPN using Cisco ASA-to-ASA HA firewalls.  All of the offices APs are configured with FlexConnect and local switching, same as all other sites on the controller.  Whenever in the past that I have taken the controller down for maintenance or the controller site has been down, none of the offices configured on this controller lost ability to use their wireless networks.  I have an identical WLC5508 in the US with numerous offices connected, configured the same, and whenever that controller has been inaccessible by the offices, they continued to be able to utilize their wireless networks.  I have been through the config at least fifty times trying to figure out what is missing or incorrect and at a loss.  Looking for some direction to try next.  Need to keep these WLC5508's going til we refresh and move to the AIR-CTVM-K9 likely in 2020.  Thank you in advance!    

[Jaderson Pessoa]

Hello,

I think that your aps working in tunnel mode, try sets their configuration to local mode. Because in canse your controller has down your ap still working normally.

check it for more information: 

https://community.cisco.com/t5/other-wireless-mobility-subjects/wlc-mode-aps-local-or-bridge/td-p/2709413

[todd.neiert@asg.com]

Jaderson, I have them in FlexConnect and local switching and do not have any ACLs applied that would cause them to have to bridge back to the WLC.  Maybe I am missing another piece but sure can't find it.