Flex Connect - AP StandAlone mode_New Connections

[Ivan Martin]

Hi I'm Ivan

I would like to know, If is possible with AP in stadalone mode (using architecture  Flex connect Central Auth-Local Switc) when it losss conectivity with  WLC 9800, it could authenticate new end users (in the failure)?

We have reviewed, on failure, AP keeps the connection of end users with TLS, LWA, PEAP. But If some end user reauthenticate (in the branch site) for any reason (Windows suspend examp) he could not access to wifi DOT1X.

Thanks you for your advices,

Kind regards. 

[Haydn Andrews]

it depends on if the SSID is configured with Local Authentication

But for 802.1x SSIDs you would also need to define the RADIUS server/ certificate to the APs, that being said if the RADIUS server is not local to the site then there is no point.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213921-flexconnect-configuration-with-central-a.html 

[Ivan Martin]

Flex is central auth local switching
Wlan is central no local. With some tests, user in the failure never authenticate, because radius traffic never reach out AAA server. Does exists some way to provide access?. I have local ldap

Kind regards Ivan

[Scott Fella]

Might want to review this so you understand the different states when using central vs local. This way you understand the risk of doing either modes.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_flex_connect.html?bookSearch=true#flexconnect-authentication-specific-details_920cf537-f385-4053-a815-b72e94b21120

[Rich R]

As @Haydn Andrews says the only way to support 802.1x in standalone mode is with local radius authentication, configured in the flex profile.  https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-15/config-guide/b_wl_17_15_cg/m-sniffer-cg.html#flex-ap-local-auth
There are a few examples of using central auth as primary with fallback to local auth.