Cisco WLC 9800 Flexconnect mode AP native Vlan same as User Vlan

[Cheah Lit Thor]

I have 2 segment vlan 100 & vlan 101 at the branch office and design to put the Flexconnect AP native vlan and user vlan together which is vlan 100 and vlan 101 for Production vlan.

The best practice is separate the AP management vlan separately but  in this case is it still possible to assign as a same one with user vlan "vlan 100"?

What i'm thinking is the WLC 9800 at central only care about the Native vlan ID but not the IP Address however any limitation on this configuration way?As the user vlan will consider an untagged traffic in branch network.

interface GigabitEthernet2

switchport trunk native vlan 100
switchport trunk allowed vlan 100-101
switchport mode trunk
spanning-tree portfast trunk 
no shut

Thanks

[MHM Cisco World]

Sorry Can you more elaborate I couldn't understand, 
there are two VLAN 
one is native VLAN for AP management VLAN 100 
and other for User VLAN 101

now what you want to do?

[Cheah Lit Thor]

Hi

One is vlan 100 for native AP management Vlan and User traffic, vlan 101 is production traffic.

My question can i put AP native vlan and user traffic under same vlan for flexconnect mode. 

Thanks

[MHM Cisco World]

If this local AP then it OK but flex connect can not, 
only I think in one case that you make WLAN is central switching not local switching, in that case you can use one vlan "native" and WLC will do WLAN-VLAN mapping. 

[Cheah Lit Thor]

Thanks to your answer.

[Arshad Safrulla]

If your requirement is to assign the VLAN100 for users then do not configure any VLAN under the policy profile, the WLC assigns vlan-id 1 so clients will use the AP native VLAN for FlexConnect AP's. If you require you can configure VLAN ID 1 (not the default VLAN).

[Cheah Lit Thor]

Sorry i didn't get you can you please explain further? by the way thanks to your replied.

[JPavonM]

Yes it will work without any problem now.

At the early stages of IOS-XE on C9800 there was an issue where AP3700 were unable to forward traffic for clients ona a WLAN mapped to the same NAtive VLAN.

I wouldn't recommend this kind of deployments to avoid any future issue.

To sum up over the last comment, using same VLAN for users and APs would potentially lead to a lack of security as any user connected to WLAN could create a DoS over the AP. Using separarated VLANS you can filter all traffic from users to management VLAN with an ACL to avoid this.

HTH
-Jesus
*** Please rate helpful responses ***

[Cheah Lit Thor]

Hi Thanks your answer.

May you please convenience to share me the document to stated this so i can further study on it? Appreciate.

(Yes it will work without any problem now.

At the early stages of IOS-XE on C9800 there was an issue where AP3700 were unable to forward traffic for clients ona a WLAN mapped to the same NAtive VLAN.)