WPA with PSK

[qsosan20]

Should I be able to use wpa with psk ssid on a flexconnect AP when it's derigestered from wlc?

What is the expected behavior for already connected users VS new sessions? 

[MHM Cisco World · Accepted solution]

from cisco doc.

When a FlexConnect access point enters standalone mode, WLANs that are configured for open, shared, WPA-PSK, or WPA2-PSK authentication enter the “local authentication, local switching” state and continue new client authentications. 

MHM

[qsosan20]

Even if ssid configured as central authentication? 

[Rasika Nayanajith · Accepted solution]

In the PSK scenario (central or local auth), it will work even WLC is disconnected.

HTH
Rasika
*** Pls rate all useful responses ***

[qsosan20]

Thank you guys 

[Rich R]

Yes - but only if the WLAN is not configured for any central auth, association, dhcp or switching:

wireless profile policy my-policy-profile
no central association
no central authentication
no central dhcp
no central switching

In other words the WLAN must be entirely reliant on AP and local resources, not the WLC.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_flex_connect.html
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html

[qsosan20]

But Cisco doc only mentioned below :

When a FlexConnect access point enters standalone mode, WLANs that are configured for open, shared, WPA-PSK, or WPA2-PSK authentication enter the “local authentication, local switching” state and continue new client authentications. This configuration is also correct for WLANs that are configured for 802.1X, WPA-802.1X, WPA2-802.1X, or Cisco Centralized Key Management, but these authentication types require that an external RADIUS server be configured.

Other WLANs enter either the “authentication down, switching down” state (if the WLAN was configured for central switching) or the “authentication down, local switching” state (if the WLAN was configured for local switching).

[Rich R]

Not sure what you're trying to say but think about it - anything that is configured for central handling must get sent to WLC so if WLC is not reachable they won't work.  The only exception is 802.1x (referred to in that paragraph) which has a fallback capability if local radius server(s) are configured in the flex profile.  When the AP goes into standalone mode the AP will send the radius directly to the configured radius servers instead of to WLC over CAPWAP.