Flex Profile Maximal

[hs08]

Hello,

My AP running using flex connect with WLC9800 and i will build dynamic vlan for this SSID. The vlan will be based on the department and i have more than 40 depts. The issue is when i create flex profile then i add vlan mapping then i got 'The maximum number of interfaces 16 have been added to the flex-profile.

How i can add more than 16?

[hs08]

If we split by creating mutiple flex profile then this not solve my issue because each AP only can connect to 1 flex profile. Imagine if the user move from 1 AP to another, then the client will have loss connection.

[aleabrahao]

@Stefan Mihajlov  take a look at my first commentary, this is not a option, because you just can configure on flex profile for each access point.

To be honest, the best option on this case is reduced the number of VLANs.

[Rich R]

> To be honest, the best option on this case is reduced the number of VLANs.

Agreed with that - more than 16 VLANs is just extreme overkill.

Otherwise you have to change to central switching on WLC.

[hs08]

this mean change from flex to local, right?

[aleabrahao]

No, reduce the number of VLANs. For Wi-Fi, it's unnecessary to have such a large volume of VLANs. If your firewall allows it, it's much easier to control whatever you want to control through rules according to the user group.

[Rich R]

As @aleabrahao says the best approach is to reduce the number of VLANs.

> this mean change from flex to local, right?
No - the AP can remain in Flexconnect Mode (or change to Local Mode if you prefer) but the point is that the WLAN must be central switching (break out at WLC) not local switching.(break out on AP switchport).

[Mark Elsen]

  -  @Rich R                 If the AP remains in flexconnect, but the WLAN is centrally switch isn't then the functionality
                                   of flexconnect broken, when the controller becomes unavailable ?

  M.

[Rich R]

The flexconnect functionality only applies to locally switched WLANs @Mark Elsen 
Under the covers flex also changes some AP behaviour (not configurable) with respect to timeouts for central authentication/association (necessary for sites on WAN links when using MAB and web auth for example).

Flexconnect behaviour matrix last fully documented for AireOS at
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/112042-technote-wlc-00.html 
but as far as I know there has not been any significant change in 9800 IOS-XE.

Although there is some info for 9800 in this:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/cat-9800-flexconnect-branch-deployment-guide-og.html#Advantagesofdistributingclientdatatraffic

[hs08]

If we change from flex to local then there is no 16 vlan limitation right? So i can still fullfill one ssid with dnyamic vlan even the valn more than 40?

[Rich R]

Yes

[hs08]

Let say i move my wlc from datacenter to the main office so AP and WLC located at same location, and if the AP still in flex mode but use centralize switching then we still need to make flex profile to map the vlan?

[aleabrahao]

No, Flex Connect is just the operating mode of the access point (AP). What will determine whether the traffic is local or on the central switch is whether you enabled it in the configuration to operate on one or the other.

Don't forget that when changing the traffic to the central switch, you will need to have an SVI for each VLAN created on the WLC.