1. Overview: Mixed Central and Local Switching

I built a mixed FlexConnect design on the Catalyst 9800. Mixed means some SSIDs are centrally switched, traffic tunneled back to the WLC, and others are locally switched, with the AP forwarding frames directly onto the local LAN without hitting the controller data plane.

Why mixed? In a branch or remote site, you typically want guest or IoT traffic to break out locally while corporate traffic hairpins back to HQ through the controller. FlexConnect handles both simultaneously. The 9800 makes switching mode a policy decision, not an SSID decision. That separation keeps a mixed design clean.

2. Profile and Tag Architecture on the 9800

The 9800 uses a three-tag model to define AP behavior. Every AP gets a policy tag, a site tag, and an RF tag (Cisco Systems, “Understand FlexConnect on Catalyst 9800”). For FlexConnect, the policy tag and site tag are the ones that matter.

3. WLAN Profile to Policy Profile Mapping

Inside the policy tag, you create one or more WLAN-policy mappings. Each entry pairs a WLAN profile with a policy profile. This is the binding that tells the AP: when a client connects to SSID X, apply the switching rules from policy profile Y.

In this example, I have two SSIDs. The corporate SSID maps to a centrally switched policy profile, traffic tunnels to the WLC and exits via the controller’s SVI. The branch SSID maps to a locally switched policy profile, traffic goes directly out the AP’s switchport without touching the WLC data plane.

! Example: Policy tag with two WLAN-to-policy mappings
wireless tag policy BRANCH-POLICY-TAG
 wlan CORP-WLAN policy CENTRAL-POLICY-PROFILE
 wlan BRANCH-WLAN policy LOCAL-POLICY-PROFILE

4. Site Tag and Flex Profile: Putting APs Into Flex Mode

The site tag is what actually converts the AP into FlexConnect mode. Inside the site tag, you reference a Flex profile. When the AP joins and receives a site tag that has a Flex profile attached, it transitions to FlexConnect mode. This triggers an AP rejoin (Cisco Systems, “Understand FlexConnect on Catalyst 9800”).

! Flex profile with local VLAN mappings
wireless profile flex BRANCH-FLEX-PROFILE
 native-vlan-id 10
 vlan-name BRANCH-DATA vlan 20
 vlan-name BRANCH-VOICE vlan 30

! Site tag referencing the Flex profile
wireless tag site BRANCH-SITE-TAG
 ap-profile DEFAULT-AP-PROFILE
 flex-profile BRANCH-FLEX-PROFILE
 local-site

The local-site keyword under the site tag is critical. It tells the controller this is a remote/branch site where the AP should operate in standalone capable mode and locally switch traffic per the Flex profile (Cisco Systems, “Understand FlexConnect on Catalyst 9800”).

5. VLAN Behavior: Central vs. Local Switching

This is where the trunking and VLAN awareness requirements at the AP switchport come in. Centrally switched SSIDs tunnel traffic to the WLC, the AP switchport only needs access to the management VLAN for the CAPWAP tunnel. Locally switched SSIDs forward traffic directly, the AP switchport must trunk all locally switched VLANs.

If the AP switchport is missing a locally switched VLAN in its trunk allowed list, clients on that SSID will associate but fail to get an IP. The AP is forwarding the frames, they just have nowhere to go at layer 2. This is one of the most common misconfiguration points I see in FlexConnect deployments.

6. DHCP for Locally Switched Clients

For centrally switched clients, the WLC has an SVI and can act as a DHCP relay or run a local DHCP pool. That plumbing does not exist for locally switched clients (Cisco Systems, “Understand FlexConnect on Catalyst 9800”). The WLC is not in the data path. DHCP requests exit the AP directly onto the local VLAN and must reach a DHCP server on the local network.

Validate this during deployment. A quick test: associate a client to the locally switched SSID and run a packet capture on the AP switchport. You should see the DHCP Discover going out unencapsulated on the correct VLAN. If it is showing up in a CAPWAP tunnel, your policy profile still has central switching enabled (Cisco Systems, “Understand FlexConnect on Catalyst 9800”).

! Verify DHCP behavior, client should pull from local network
show wireless client detail mac-address <CLIENT-MAC>
! Check "Policy Profile" field and "VLAN" assignment
! "Central Switch" should read "No" for local switching

7. ACL Placement for Local Switching

ACLs on the 9800 for centrally switched clients are applied in the policy profile and enforced on the WLC. For locally switched clients, the WLC is not in the data path, so an ACL applied only in the policy profile will not be enforced (Cisco Systems, “Understand FlexConnect on Catalyst 9800”). The ACL must also be defined in the Flex profile so it gets pushed down to the AP and enforced locally in the AP data path.

! ACL defined on the WLC
ip access-list extended BRANCH-LOCAL-ACL
 permit ip 192.168.20.0 0.0.0.255 any
 deny   ip any any

! Applied in the policy profile
wireless profile policy LOCAL-POLICY-PROFILE
 ipv4 acl BRANCH-LOCAL-ACL

! Also referenced in the Flex profile so it is pushed to the AP
wireless profile flex BRANCH-FLEX-PROFILE
 acl-policy BRANCH-LOCAL-ACL

8. Verification: Show Commands

After configuration, verify tag assignment, profile state, and client policy with these show commands. These are the ones I run every time before I call a FlexConnect deployment complete (Cisco Systems, “Understand FlexConnect on Catalyst 9800”).

! Verify AP tag assignments
show ap name <AP-NAME> config general | include Tag

! Detailed view of a policy tag and its WLAN-policy bindings
show wireless tag policy detailed <POLICY-TAG-NAME>

! Detailed view of the site tag, confirm Flex profile is bound
show wireless tag site detailed <SITE-TAG-NAME>

! Verify the policy profile switching mode
show wireless profile policy detailed <POLICY-PROFILE-NAME>

! Check AP Flex mode and VLAN mappings pushed to the AP
show ap name <AP-NAME> flex

! Verify a connected client's policy, confirm local switching
show wireless client detail mac-address <CLIENT-MAC>

In the show wireless client detail output, look for the Central Switch field. It should read No for a locally switched client. If it reads Yes, your policy profile is still set to central switching or the correct policy tag is not bound to that AP.

Also check the VLAN field in the client detail output. It should match the VLAN you defined in the Flex profile for that SSID, not a WLC-side VLAN. If the VLAN looks right but DHCP is failing, go back to the access switch and verify the trunk allowed list on the AP switchport.

Works Cited