Authentication at AP and local radius server

[Leftz]

Hi For local authentication with Flexconnect, is there any difference between authentication at the AP and at local radius server? 

Thank you. 

[Arshad Safrulla]

Flex Connect local auth will make sure that the authentication is done at the AP locally. In the case of a AAA server radius packet will be sent directly from the AP instead of WLC. So you need to have all the AP's added as NAD's. 

Cisco gives you the flexibility to configure local authentication in a way it will be either used as the primary and only source of authentication or will be used only when the WAN link is down and WLC is not reachable from remote branch.

More on local switching local auth in Flex on the below link

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/flexconnect.html#flex-ap-local-auth-on-ap-gui

[Leftz]

Thank you Arshadsaf, so when we mention Flex Connect local auth, it refers to authentication happening at AP. Is this correct? 

[Scott Fella]

That is correct.  Search "local authentication" on this page for further reference.

Cisco Wireless Controller Configuration Guide, Release 8.4 - FlexConnect [Cisco Wireless LAN Controller Software] - Cisco