What is FlexConnect local switching?

The controller keeps central AP management, while wireless client data is placed onto a VLAN by the branch AP and switched through the local branch network.

Should employee WLANs use a shared PSK?

Enterprise 802.1X with WPA2 or WPA3 is preferred because it provides individual identity, policy and accounting instead of one shared secret.

Back to BlogsMay 12, 2026 · Part 5 of 6

Catalyst 9800 FlexConnect, RADIUS and WLAN Security

Choose the correct client data path for campus and branch sites, configure FlexConnect local switching, and replace shared passwords with identity-based access.

FlexConnect802.1XRADIUS

Central switching versus FlexConnect local switching with wireless troubleshooting ladder

Quick Learning Map Catalyst 9800 FlexConnect, RADIUS and WLAN Security

1Central switching vs FlexConnect2Configure FlexConnect local switching3Configure the branch AP port4Move production users to enterprise authentication

Catalyst 9800 FlexConnect, RADIUS and WLAN Security cheat sheet: use this quick map before reading the detailed sections.

Central switching vs FlexConnect

Decision	Central switching	FlexConnect local switching
Client data path	AP → CAPWAP → WLC → VLAN	AP → local switch → branch gateway
Control path	CAPWAP to controller	CAPWAP to controller
AP switch port	Usually management access VLAN	Trunk with native AP VLAN and client VLANs
Best fit	Campus and central enforcement	Branches, WAN efficiency and local survivability

Configure FlexConnect local switching

configure terminal
wireless profile policy BRANCH-WIFI-POLICY
 no central switching
 vlan 30
 no shutdown

wireless profile flex BRANCH-FLEX-PROFILE
 native-vlan-id 20
 vlan-name WIFI-CLIENTS
 vlan-id 30

wireless tag site BRANCH-SITE-TAG
 flex-profile BRANCH-FLEX-PROFILE
 no local-site

wireless tag policy BRANCH-POLICY-TAG
 wlan NETEST-CORP policy BRANCH-WIFI-POLICY

ap aaaa.bbbb.cccc
 policy-tag BRANCH-POLICY-TAG
 site-tag BRANCH-SITE-TAG

The three essential changes are no central switching, a Flex profile with VLAN mappings, and a site tag with no local-site.

Configure the branch AP port

interface GigabitEthernet1/0/10
 switchport mode trunk
 switchport trunk native vlan 20
 switchport trunk allowed vlan 20,30
 spanning-tree portfast trunk

Design check: VLAN 30 must exist locally at the branch, and its DHCP relay, gateway, ACLs and Internet path must be configured there.

Move production users to enterprise authentication

A corporate 802.1X WLAN sends authentication through the WLC to a RADIUS service such as Cisco ISE. The server can return permit or deny, VLAN, downloadable ACL, security group tag, QoS, session timeout or redirect policy.

Controller side

RADIUS servers and server group
Authentication and accounting method lists
WPA2/WPA3-Enterprise WLAN
Policy profile and policy tag

Identity side

WLC defined as a network device
Matching shared secret
Certificate trust
Identity and authorisation policies

Preferred order: WPA3-Enterprise, WPA2-Enterprise with AES, WPA3-Personal, then WPA2-Personal with AES. Avoid WEP, TKIP and open corporate WLANs.

Production hardening checklist

Separate WLC, AP, employee, guest, IoT and management networks.
Restrict GUI and SSH to trusted management subnets.
Use HTTPS, SSH, SNMPv3, AAA administration, syslog, NTP and backups.
Use meaningful WLAN, policy, site, RF and AP names.
Avoid excessive SSIDs; use identity policy and dynamic VLANs.
Choose a recommended IOS XE release after checking release notes, caveats and AP support.
Base RF settings on a site survey and real device requirements.

Branch Design Notes

FlexConnect changes where traffic is switched, but it does not remove the need for a clear identity and VLAN design. Decide how a branch behaves during a WAN interruption, where DHCP and gateway services live, and whether authentication is expected to remain available.

For RADIUS troubleshooting, separate transport from policy. An unreachable server is a routing, ACL, DNS or shared-secret problem. A reachable server that rejects a user is an identity, certificate, method or authorization problem. Test those categories one at a time.

Protect local switching with management ACLs, strong AP credentials, secure RADIUS settings and a restricted native VLAN. Test both a normal login and a deliberate failure so operators know what a healthy rejection looks like.

Implementation Checklist

Write down the branch failure behavior before deployment. Decide whether users should keep local access, whether cached identity is permitted, how long it is valid, and which services must remain reachable if the WAN is unavailable. These are design decisions, not settings to discover during an outage.

Test a successful authentication, an invalid credential, an unavailable RADIUS server and a returned authorization attribute. Confirm that each result produces the intended VLAN and access behavior. Save the timestamps and logs so the identity team and network team can compare the same event.

Catalyst 9800 FlexConnect, RADIUS and WLAN Security Frequently Asked Questions

Does FlexConnect remove the controller?

No. The AP remains centrally controlled through CAPWAP; only the configured client data is switched locally.

Why does a FlexConnect AP port need a trunk?

The port must carry the AP management VLAN plus every locally switched wireless-client VLAN.

What can RADIUS assign dynamically?

Depending on the design, RADIUS can return a VLAN, ACL, security group tag, QoS, redirect and session policy.