Flex Connect

[hs08]

Hello,

What disadvantages if we use AP in flex connect mode if we have slow link or intermittent link from AP to the controller?

Will the client disconnected when move across APs?

[ammahend]

No, client will not disconnects if the AP looses connection to wlc. 

flexconnect does support 802.11r with local key caching, i guess the only time you will have an issue is when AP reboots in standalone mode (disconnected from controller)

[hs08]

So when normal condition where the AP have good link to the controller the client will not disconnect when roam across AP, am i right? And if the link is slow or intermittent the client will disconnected when roaming?

[ammahend]

In both cases client should roam seamlessly between flexconnect APs because of 802.11K protocol, the AP client is currently connected to will provide it with information regarding neighboring APs and their channels. This way when the client is ready to roam, it has a better idea of where it will be roaming to, this is irrespective of if AP is currently connected to WLC or not.

Secondly because 802.11r, this allow encryption keys to be stored on all of the APs on that flexconnect group. This way, a client doesn't need to perform the complete authentication process to a backend server every time it roams to a new AP within the network, so even if the controller is disconnected, client can roam to another AP without doing full auth.

As I mentioned earlier exception can be when link to controller is disconnected and AP reloads in standalone, I think in this case client can not roam to this AP.

Obviously this is with assumption that client supports both these protocols and you have these enabled on WLC, which most modern client will do.

[JPavonM]

Adding to @ammahend comment, clients will disconnect if they need to roam, and will also disconnect due to OS defects like the one impacting Windows clients when using SHA256 AKM. Cisco has patched this behaviour (https://bst.cisco.com/bugsearch/bug/CSCwd91054) until Microsoft implement a fix in the next year, but that patch is on 17.9.3 APSP1, 17.9.4, 17.9.5 and 17.12.2

[MHM Cisco World]

If yoh have slow wan between ap and wlc you can sure use flex mode.

BUT 

The l2 or l3 secuirty is what you need to notice' for example if you use 802.1x for wlan that meaning all ap need to connect to radius.

Instead you can make auth centralize in wlc and the ap do all traffic switching.

Also for dhcp you can make ap forward dhcp request to wlc (which connect to dhcp server).

MHM