Cisco WLC, lightweight APs and arranging local Internet breakout

[Habibul Mumin]

Hope someone can help.  Customer has existing scenario:

1. WLC in datacentre

2. Lightweight APs in main office

3. Currently all traffic for WLANs go to WLC in datacentre and is conrolled and managed

Customer want to add a DSL circuit in main office purely for guest Internet access.  What change would I need to make to infrastructure so guest WLAN does not travel to WLC in datacentre but simple breaks out through local network and DSL circuit?

Is there an option to use autonomous APs?

[marce1000]

 - It's bad design to go back to autonomous AP's ; best is to transform or make the DSL line available as a VLAN in the datacentre and make a WLAN that can associate with it. 

M.

[jturner2720]

That sounds exactly what FlexConnect is designed for. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/Enterprise-Mobility-8-5-Design-Guide/Enterprise_Mobility_8-5_Deployment_Guide/ch7_HREA.html

Change the APs to FlexConnect mode, set up for guest WLAN to map to a vlan on the local network that's trunked up to the APs.

[Scott Fella]

Yup... FlexConnect local switching is what you need to move to. Your aps would have to be connected via a trunk port that has the guest vlan, the aps would need to be converted from local to FlexConnect and the guest said would need to have FlexConnect local switching enabled. Please read the guide as FlexConnect group has limitations to how many aps can be in a group to have seamless roaming. Also note that roaming needs to be layer 2 as layer 3 is not supported. Means clients have to be in the same subnet.

[Habibul Mumin]

Thanks, I wasn't aware of this.

[d.novakovic]

Hi ..
What about this scenario

1. AP connected in branch office to ISP Router, gets IP from ISP Router
2. OEAP Capwap connection to WLC in Datacenter via Internet
3. User authenticates via 802.1X to some SSID successfully
4. User has local breakout in the location (pure internet via the local ISP Router), without trunk port (as its a cheap ISP router no vlans)

possible?

[jturner2720]

I've got a few locations with pretty much that situation. You set the SSID you want to break out locally as FlexConnect. The difference from before is you don't configure any mappings for the WLAN to a VLAN. Without that it will by default drop the traffic onto the untagged network the AP is using for everything else.