Despite Flexconnect APs stop working when controller unreachable

[safiullahtariq1]

Hello

I have a very strange problem as I said in the subject, I have flexconnect enabled and other all related settings enabled but still when controller is unreachable, the APs stop showing SSID and stop working. 

Controller is: Cisco Catalyst 9800-CL Wireless Controller 17.13.1 (less than 50 APs) so no issue about licensing. 

APs are: 3802i with firmware version ap3g3-k9w8-tar.153-3.JPR

And this is kind of intermittent, when I turn on the AP while having a firewall rule to block the controller, it works fine. but when it is already ON and working and then the controller is not reachable, it stops beaconing the SSID and lights start changing color. I am attaching the startup config.

[safiullahtariq1]

I am really sorry for the late reply. I am checking the Userwise AP tags. 

Fine Conclusion. When there is a firewall or routing issue, then it keeps working. 
but

but

When in running condition, if the VM of Controller is Powered Off, only then it loses the SSID. 
else in every other case like enabling the firewall to limit access to controller etc, or disabling VPN to lose route to controller, we dont lose the SSID.

Isnt this strange ??