WLC Flex Connect

[hs08]

Hello,

AP for branch office registered to the WLC in Main Office, and the AP using flex connect mode.

If we see in below picture, VLAN 250, 118, 124, 117, 131 is not exist in the Main Office, only VLAN management 303 exist in the main office.

With this condition why we cannot access to the WLC management from the branch LAN? The WLC management now only can be accessed from Main Office LAN.

Pinging the WLC management address is success from branch LAN

But from WLC is not able to ping to all VLAN listed in the interfaces, example ping from WLC to VLAN 250 gateway (10.100.50.1)

In the branch office there also have VLAN 200 where this VLAN is not listed in the WLC and pinging from WLC to this VLAN is succeed

Anyone know why?

[MHM Cisco World]

Flex AP and from wifi client sure you can not ping wmi of wlc.

Flex VLAN is not config in WLC so wlc can not reply to ping.

But still from AP IP you can ping to wlc wmi. Wlc know AP IP that how AP join WLC.

MHM

[hs08]

So it's normal that we not able access to the WLC if accessing from Flex VLAN?

[MHM Cisco World]

Sure Yes' and as you mention in your post these vlan is missing from WLC.

MHM

[hs08]

No other way to enable this?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215967-9800-with-flexconnect-oeap-with-split-tu.html

I hope I am correct but split tunnel is only solution I see 

MHM

[Ambuj M]

If these vlans only exist in remote location where flexconnect APs are then these vlan don’t even need to exist on wlc, you can just define your branch SSID to VLAN mapping under flex connect group and push to branch AP. 

[Rich R]

Like @Ambuj M says the whole point of Flex local switching VLANs is that they only exist at the AP location not on the WLC.
If you want to connect between site local VLAN and central VLAN you need a router network to provide that routing between the networks which are totally separate.