Like Marce says OEAP is not used much anymore. The key points which distinguish OEAP:
- Mandatory CAPWAP data tunnel encryption. For companies that don't think VPN, TLS etc is enough to protect their user data. This substantially increases CPU load on the AP (and the WLC) thus limiting the throughput of the AP so performance/throughput is always worse than a similar standard AP setup.
- The AP provides a very rudimentary page for the user to setup their own local SSID. This page is not well maintained at all, looked like something out of ancient history last time I looked at it but maybe it's been updated since then.
Very few companies require that encrypted CAPWAP data these days. With zero trust networks the assumption is that all underlying transport is untrusted so the device must ensure end to end security/encryption without relying on the WiFi or network to be encrypted. This is necessary anyway if the device is allowed to access public hotspots.
Most home broadband routers provide the user with a home SSID with a much more modern and flexible GUI to manage it so the AP local SSID is usually not needed at all.
So the simple solution is:
- AP in flexconnect mode
- Corporate SSID with central authentication, central switching, central DHCP which is tunnelled back to the WLC
- Local user SSID (only if required) with local authentication, local switching, local DHCP which breaks out on the local switch port, never going anywhere near the WLC.
- The AP gets its IP address from the home broadband router just like any other client on the home network or you assign it a static IP from the reserved part of the home IP range.
- I would stay away from using split tunnels at all - corporate SSID should be corporate only and local SSID should be local only. The only use-case I've come across for split tunnel is user wanting to print to local home printer but frankly it's easier to tell the user to connect to their home SSID if they want to print.
But in fact very few companies would extend a corporate SSID to a user's home these days because Google/Microsoft 365 apps require direct cloud access - nobody wants all that traffic traversing their corporate network anymore. So in most cases users simply connect to their own home SSID and then a VPN on the client is used to route the corporate traffic to the company network over VPN while the Google/Microsoft cloud traffic routes directly to the local internet connection. That also simplifies user access to a printer on the local home network. The split tunnelling is done in the VPN client.
ps: if you desperately want to you can still enable CAPWAP data encryption for the AP even without using OEAP but remember the performance impact it will have. I've also noticed a number of bugs that have popped up over the years related to CAPWAP data encryption being enabled because it simply isn't used or tested as much as unencrypted CAPWAP data on the AP.
