7.1 Access Point Operational Modes & FlexConnect Architecture

7.1 Access Point Operational Modes & FlexConnect Architecture

Core Blueprint Focus: Domain 4.0 (Wireless Network Operation) accounts for 20% of the Cisco WLCOR 350-101 examination. Designing, operating, and troubleshooting enterprise wireless fabrics requires an in-depth understanding of Cisco Access Point (AP) operational modes and mastery of the FlexConnect branch architecture. Wireless engineers must evaluate how each AP mode alters the wireless control, data, and diagnostic planes, configure resilient switching and authentication matrices, deploy FlexConnect ACLs, and plan for WAN survivability during network partitions.

---

1. Cisco Access Point Operational Modes Taxonomy

Cisco Catalyst Access Points running native AP-COS (or Cisco IOS-XE on modular platforms) can be provisioned into distinct operational modes. An AP's operational mode dictates its radio transmission behavior, whether it serves wireless clients, whether it encapsulates data frames into CAPWAP tunnels, and how it participates in RF monitoring and diagnostic workflows.

+-------------------------------------------------------------------------------------------------+
|                               CISCO ACCESS POINT OPERATIONAL MODES                              |
|                                                                                                 |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|  |         LOCAL MODE        |  |      FLEXCONNECT MODE     |  |      BRIDGE / MESH MODE     |  |
|  | - Campus Centralized Data |  | - Branch Local Switching  |  | - Outdoor P2P / P2MP Bridges|  |
|  | - CAPWAP Data (UDP 5247)  |  | - WAN Failure Resilient   |  | - AWPP Dynamic Path Routing |  |
|  | - Default Enterprise Mode |  | - Native 802.1Q Branch Trk|  | - Root AP (RAP) & Mesh (MAP)|  |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|                                                                                                 |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|  |        SNIFFER MODE       |  |     MONITOR / wIPS MODE   |  |     ROGUE DETECTOR MODE     |  |
|  | - Over-the-air 802.11 pcap|  | - Dedicated Full-Time WIPS|  | - Wired ARP/MAC Correlation |  |
|  | - UDP 5555 to Wireshark   |  | - CleanAir Spectrum Sensor|  | - Listens on Wired Trunks  |  |
|  | - Radiotap Header Metadata|  | - No BSSID Beaconing      |  | - Radios completely OFF     |  |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|                                                                                                 |
|  +----------------------------------------------------------+  +-----------------------------+  |
|  |                      SE-CONNECT MODE                     |  |         SENSOR MODE         |  |
|  | - Raw Layer 1 Fast Fourier Transform (FFT) Data Stream   |  | - Synthetic Client Testing  |  |
|  | - TCP Port 37540 to Cisco Spectrum Expert PC Console     |  | - Validates DHCP, DNS, SaaS |  |
|  | - Analyzes Non-Wi-Fi Physical Layer RF Interferences     |  | - DNA Spaces SLA Telemetry  |  |
|  +----------------------------------------------------------+  +-----------------------------+  |
+-------------------------------------------------------------------------------------------------+

Primary Client-Serving Modes

1. Local Mode (Default Enterprise Campus Mode):

   • The baseline operational mode for traditional centralized enterprise campus networks.
   • The AP maintains two concurrent Datagram Transport Layer Security (DTLS) tunnels to the Cisco Catalyst 9800 Wireless LAN Controller (WLC): a CAPWAP Control tunnel (UDP 5246) and a CAPWAP Data tunnel (UDP 5247).
   • Data Plane Handling: When an 802.11 client transmits a data frame over the air, the Local mode AP receives the frame, translates the 802.11 MAC header into an 802.3 Ethernet frame, encapsulates the frame within a CAPWAP Data packet, and routes it across the wired underlay to the central WLC. The controller decapsulates the CAPWAP header and bridges the 802.3 frame onto the appropriate campus VLAN.
   • RF Time-Slicing: While serving clients on its assigned operational channel, a Local mode AP periodically goes off-channel for brief time slices (typically 50 ms every few seconds) to scan other regulatory channels for rogue APs, interference, and Radio Resource Management (RRM) neighbor discovery packets.

2. FlexConnect Mode (Distributed Branch Architecture):

   • Engineered specifically for distributed enterprise branches, retail stores, remote clinics, and warehouse facilities connected to a central data center controller across bandwidth-constrained, high-latency, or unreliable WAN links.
   • Data Plane Decoupling: Allows client data frames to be switched directly onto the local branch access switch (Local Switching) or tunneled back to the central controller (Central Switching) on a per-WLAN granularity.
   • WAN Resiliency: Retains a CAPWAP Control tunnel to the central WLC for RRM, software image orchestration, and telemetry. If the WAN fails, the FlexConnect AP autonomously transitions into Standalone mode, preserving local network operations.

3. Bridge / Mesh Mode:

   • Engineered for outdoor enterprise campuses, municipal Wi-Fi networks, industrial yards, and historical structures where pulling copper or fiber cabling is physically impossible or cost-prohibitive.
   • Access Points operate in one of two hierarchical roles:
     • Root Access Point (RAP): Physically tethered to the wired core/distribution network via an Ethernet uplink. The RAP bridges traffic between the wired infrastructure and the wireless mesh backhaul.
     • Mesh Access Point (MAP): Has no physical wired connection to the core network. It connects wirelessly to a RAP (or another intermediate MAP) over a dedicated 5 GHz or 6 GHz backhaul radio link while concurrently serving client associations on its 2.4 GHz, 5 GHz, or 6 GHz access radios.
   • Adaptive Wireless Path Protocol (AWPP): Cisco's proprietary Layer 2 routing protocol for wireless mesh topologies. AWPP dynamically calculates the optimal wireless path back to the RAP using a link quality metric based on Signal-to-Noise Ratio (SNR), hop count, throughput capacity, and link stability. If an intermediate MAP fails or suffers severe RF degradation, AWPP automatically re-converges traffic around the point of failure.

Specialized Non-Client Diagnostic & Security Modes

1. Sniffer Mode:

   • Dedicated over-the-air packet capture mode used for deep Layer 1/Layer 2 diagnostic troubleshooting. In this mode, the AP terminates all client service, ceases beaconing SSIDs, and turns off client associations.
   • The AP locks its radio receiver onto a specific regulatory channel and channel bandwidth (20 MHz, 40 MHz, 80 MHz, or 160 MHz).
   • The AP captures every 802.11 frame transmitted across that frequency—including Beacons, Probe Requests/Responses, RTS/CTS, Block ACKs, 802.11 EAPoL 4-way handshakes, and encrypted data payloads.
   • Radiotap Encapsulation: The AP prefixes each captured 802.11 frame with a Radiotap header containing physical layer RF metadata (such as RSSI, SNR, channel frequency, noise floor, modulation coding scheme [MCS], antenna index, and timestamp).
   • Network Streaming: The AP encapsulates the Radiotap-framed 802.11 packet inside an IP/UDP datagram with destination UDP port 5555 and streams it across the IP network directly to an engineering workstation running Wireshark or Omnipeek.
   • Exam Distinction: Unlike wired SPAN/RSPAN ports that only capture decapsulated 802.3 Ethernet frames after the AP has stripped the wireless headers, Sniffer mode captures native 802.11 MAC management and control frames essential for diagnosing roaming glitches, hidden node collisions, and 802.11w Protected Management Frame negotiation failures.

2. Monitor Mode (Dedicated wIPS & CleanAir Sensor):

   • The AP turns off its transmitter and functions exclusively as a dedicated full-time radio sensor. It serves zero clients and advertises no SSIDs.
   • Rather than remaining on a single channel, a Monitor mode AP continuously cycles through all regulatory channels in its regulatory domain, dwelling on each channel for a configured interval (e.g., 100 ms to 250 ms).
   • Wireless Intrusion Prevention System (wIPS): Performs full-time signature analysis to detect spoofed MAC addresses, deauthentication/disassociation flood denial-of-service (DoS) attacks, rogue APs, honeypots, and unauthorized ad-hoc networks.
   • CleanAir Spectrum Analysis: Continuously evaluates the RF spectrum for non-Wi-Fi interferers (video transmitters, microwave ovens, industrial cordless phones, radar pulses) and reports real-time Air Quality Index (AQI) metrics to the WLC.
   • Deployment Reality: Used in defense, financial trading, and healthcare environments where 100% duty-cycle threat surveillance is legally mandated, eliminating the monitoring blind spots inherent in Local mode time-slicing.

3. Rogue Detector Mode:

   • A specialized wired-infrastructure defense mode designed to identify whether a rogue wireless device is physically connected to the enterprise wired network.
   • Radio State: The AP's wireless radios are completely disabled. The AP does not transmit or receive any 802.11 RF energy.
   • Wired Promiscuous Monitoring: The AP's wired Ethernet port is connected to a trunk port on a core or distribution switch carrying multiple campus VLANs. The AP places its wired interface into promiscuous mode, capturing all broadcast Address Resolution Protocol (ARP) requests, DHCP requests, and Layer 2 MAC address frames traversing the wired subnets.
   • Correlation Mechanics: The Rogue Detector AP continuously forwards these captured wired MAC and ARP bindings to the Catalyst 9800 WLC. The WLC cross-references the wired MAC table against the list of rogue BSSIDs and rogue client MAC addresses detected over the air by neighboring Local or Monitor mode APs.
   • If a match is identified—meaning a rogue BSSID or a client connected to a rogue AP appears in the wired ARP table—the WLC immediately flags the rogue device as a Rogue on Wire, escalating its threat level to Rogue (Critical) and triggering automated switchport containment via CDP/LLDP port shutdown.

4. SE-Connect (Spectrum Expert Connect):

   • A dedicated physical layer (Layer 1) diagnostic mode. Client service is terminated.
   • The AP's CleanAir ASIC captures raw Fast Fourier Transform (FFT) radio frequency energy across the 2.4 GHz, 5 GHz, or 6 GHz spectrum.
   • The AP packages raw In-Phase/Quadrature (I/Q) spectrum samples and power spectral density (PSD) data into a continuous TCP stream (default TCP port 37540) directed to a PC running the Cisco Spectrum Expert desktop client.
   • RF engineers analyze sweeping spectrograms, duty cycle charts, and real-time FFT plots to identify non-802.11 interferers that lack 802.11 MAC headers (e.g., frequency-hopping military radios, defective microwave magnetrons, wireless cameras).

5. Sensor Mode:

   • Available on Cisco Catalyst 9100 Series Access Points (and dedicated auxiliary radios on tri-radio APs). Allows the AP to reverse its operational personality and function as a synthetic client station.
   • The AP associates with production enterprise SSIDs (using 802.1X, WPA2/WPA3-Personal, or WebAuth) just like an end-user smartphone or laptop.
   • Once connected, the AP executes automated, scriptable Day-2 Service Level Agreement (SLA) tests:
     • Obtains an IP address via DHCP and verifies DHCP lease latency.
     • Resolves internal and external Fully Qualified Domain Names (FQDNs) via DNS.
     • Pings default gateways and corporate intranet routers.
     • Executes HTTP/HTTPS GET requests to cloud SaaS platforms (Cisco Webex, Microsoft 365, Salesforce) and internal web servers.
     • Performs simulated voice and video streaming throughput tests.
   • Telemetry and SLA failure metrics are streamed in real time to Cisco Catalyst Center (formerly DNA Center) and Cisco Spaces, alerting network operations center (NOC) teams to authentication, DHCP pool exhaustion, or gateway reachability failures before end users report trouble.

---

Access Point Modes Comparison Matrix

---

2. FlexConnect Architecture Deep Dive

In a centralized enterprise wireless architecture, backhauling every branch packet across an expensive WAN link to a corporate headquarters controller introduces unacceptable latency and consumes costly bandwidth. FlexConnect decouples the wireless control plane from the client forwarding plane, providing granular, per-WLAN architectural control.

Central vs. Local Switching

In the Cisco Catalyst 9800 configuration model, switching behavior is defined within the Policy Profile (wireless profile policy <name>):

• Central Switching (central-switching enabled):
  • The FlexConnect AP encapsulates client 802.11 data frames inside CAPWAP Data tunnels terminating on the central Catalyst 9800 WLC.
  • The local branch switchport sees only CAPWAP UDP packets (source IP = AP, destination IP = WLC WMI).
  • Best suited for corporate guest traffic that must be anchored into a DMZ, or restricted compliance networks where all client traffic must be inspected by centralized data center next-generation firewalls (NGFW).
• Local Switching (no central-switching):
  • The FlexConnect AP translates 802.11 frames directly into 802.3 Ethernet frames at the access layer.
  • The AP tags each frame with the appropriate 802.1Q VLAN tag and forwards it directly onto the branch access switch.
  • Traffic destined for local branch printers, file shares, or point-of-sale (POS) terminals stays within the branch LAN; internet-bound traffic exits directly via the local branch SD-WAN router or Direct Internet Access (DIA) link, drastically offloading the enterprise WAN.

Central vs. Local Authentication

Authentication behavior is similarly configured on a per-WLAN Policy Profile basis:

• Central Authentication (central-authentication enabled):
  • The FlexConnect AP relays 802.1X EAPoL frames across the CAPWAP Control tunnel to the central Catalyst 9800 WLC.
  • The WLC acts as the RADIUS Network Access Server (NAS), communicating with Cisco ISE in the central data center.
  • Delivers centralized policy auditing, dynamic role assignment, posture validation, and multi-factor authentication across the enterprise.
• Local Authentication (no central-authentication):
  • The FlexConnect AP terminates authentication locally at the branch.
  • For 802.1X/EAP, the AP acts directly as the RADIUS client, exchanging RADIUS Access-Requests with a local branch RADIUS server or domain controller.
  • Alternatively, the AP can validate credentials locally using FlexConnect Local EAP (supporting LEAP, EAP-FAST, or EAP-TLS against local user databases or branch LDAP).
  • For Pre-Shared Key (WPA2/WPA3-Personal) networks, the AP negotiates the 4-way handshake locally without contacting the WLC.

The FlexConnect Four-Quadrant Matrix

+---------------------------------------------------------------------------------------------------+
|                                 FLEXCONNECT OPERATIONAL MATRIX                                    |
|                                                                                                   |
|  +--------------------------------------------+  +---------------------------------------------+  |
|  |      LOCAL SWITCHING / CENTRAL AUTH        |  |      CENTRAL SWITCHING / CENTRAL AUTH       |  |
|  | - Standard Enterprise Branch 802.1X        |  | - Guest WLANs with Central DMZ Anchor       |  |
|  | - Auth: Central Cisco ISE via CAPWAP       |  | - Auth: Central ISE / WebAuth Portal        |  |
|  | - Data: Local Branch Switchport (802.1Q)   |  | - Data: CAPWAP Data Tunnel (UDP 5247) to WLC|  |
|  | - WAN Dependency: Initial auth only        |  | - WAN Dependency: 100% (Auth & Data)        |  |
|  +--------------------------------------------+  +---------------------------------------------+  |
|                                                                                                   |
|  +--------------------------------------------+  +---------------------------------------------+  |
|  |       LOCAL SWITCHING / LOCAL AUTH         |  |       CENTRAL SWITCHING / LOCAL AUTH        |  |
|  | - Mission-Critical Survivability (POS/IoT) |  | - Atypical / Non-Standard Architecture      |  |
|  | - Auth: Branch RADIUS / Local PSK / EAP    |  | - Auth: Branch RADIUS                       |  |
|  | - Data: Local Branch Switchport (802.1Q)   |  | - Data: CAPWAP Data Tunnel to Central WLC   |  |
|  | - WAN Dependency: ZERO (100% Autonomous)   |  | - WAN Dependency: High (Data path requires) |  |
|  +--------------------------------------------+  +---------------------------------------------+  |
+---------------------------------------------------------------------------------------------------+

802.1Q Trunking & VLAN-to-SSID Mapping

Because a locally switched FlexConnect AP bridges multiple SSIDs onto distinct wired subnets directly at the branch access layer, the switch port connecting the AP must be configured as an IEEE 802.1Q trunk port:

• Native VLAN: Carries untagged management traffic. The AP obtains its own IP address on this VLAN and establishes its CAPWAP control tunnel to the WLC.
• Tagged VLANs: Carries client data traffic tagged with specific 802.1Q VLAN IDs corresponding to distinct SSIDs (e.g., VLAN 100 for Corporate, VLAN 200 for Voice, VLAN 300 for Retail POS).

On the Catalyst 9800, VLAN mappings are configured inside the Flex Profile (wireless profile flex <profile-name>):

wireless profile flex Branch-Flex-Profile
 native-vlan-id 10
 vlan-name Corporate-VLAN
  vlan-id 100
 vlan-name Voice-VLAN
  vlan-id 200
 vlan-name POS-VLAN
  vlan-id 300

When a client associates to an SSID mapped to Corporate-VLAN, the FlexConnect AP translates the 802.11 frame to 802.3, inserts 802.1Q tag 100, and transmits it directly onto the access switch trunk.

FlexConnect Access Control Lists (ACLs)

In centralized Local mode, Access Control Lists (ACLs) are enforced on controller interfaces or SVIs. In FlexConnect local switching, however, client data frames never traverse the controller, making centralized ACLs ineffective. To maintain security boundaries, Cisco implements FlexConnect ACLs:

• FlexConnect ACLs are authored centrally on the Catalyst 9800 WLC and pushed down to the AP's flash memory during provisioning or configuration sync.
• The AP compiles and enforces these ACLs in its local forwarding path according to the WLAN, VLAN, traffic direction, and FlexConnect policy.

FlexConnect ACL Architecture encompasses three distinct operational types:

1. Pre-authentication ACLs:
   • Applied to unauthenticated client sessions before the client completes 802.1X or WebAuth authentication.
   • Used to strictly permit essential pre-auth services (DHCP on UDP 67/68, DNS on UDP 53) while blocking all access to internal corporate subnets.
2. Post-authentication ACLs:
   • Applied dynamically to an authenticated client session based on local VLAN mapping or dynamic AAA Override attributes returned by Cisco ISE.
   • Enforces role-based Layer 3/4 filtering directly at the branch AP ingress, preventing compromised branch endpoints from attacking neighboring branch devices.
3. WebAuth / Redirect ACLs:
   • Used in FlexConnect Central WebAuth (CWA) and Local WebAuth (LWA) deployments.
   • The AP inspects client HTTP/HTTPS traffic: traffic matching permit statements is intercepted and redirected to the captive portal URL, while traffic matching deny statements (such as DNS, DHCP, and traffic to the Cisco ISE server) is forwarded normally without redirection.

---

3. Connected vs. Standalone Mode Mechanics & Survivability

The primary architectural justification for deploying FlexConnect is WAN survivability. A FlexConnect AP operates in one of two distinct lifecycle states:

+---------------------------------------------------------------------------------------------------+
|                         CONNECTED VS. STANDALONE STATE MACHINE                                    |
|                                                                                                   |
|  [ CONNECTED MODE ]                                                                               |
|  - CAPWAP Control Tunnel Active (UDP 5246)                                                        |
|  - Real-Time RRM, Centralized Configuration Sync, Central ISE Authentication                      |
|  - Centrally Switched WLANs Active | Locally Switched WLANs Active                                |
|                                                                                                   |
|                           |                                                                       |
|                           | WAN Link Partitioned:                                                 |
|                           | 3 Missed CAPWAP Echo Heartbeats (Default: 30s x 3 = 90s)             |
|                           v                                                                       |
|                                                                                                   |
|  [ STANDALONE MODE ]                                                                              |
|  - WAN Connection Severed | Controller Declared Dead                                             |
|  - Centrally Switched WLANs: SHUT DOWN IMMEDIATELY (Radios stop beaconing SSIDs)                 |
|  - Local Sw / Central Auth: Existing sessions REMAIN ACTIVE; New authentications FAIL            |
|  - Local Sw / Local Auth or PSK: 100% UNINTERRUPTED SERVICE (Associations, Roaming, Forwarding)   |
|                                                                                                   |
|                           |                                                                       |
|                           | WAN Link Restored:                                                    |
|                           | AP Discovers Controller via DTLS Handshake                            |
|                           v                                                                       |
|                                                                                                   |
|  [ RE-SYNCHRONIZATION & RE-JOIN ]                                                                 |
|  - Re-establishes CAPWAP Control DTLS Session                                                     |
|  - Executes Non-Disruptive Client Database Audit (Existing client sessions NOT dropped)           |
|  - Downloads Configuration Deltas | Re-enables Centrally Switched SSIDs                           |
+---------------------------------------------------------------------------------------------------+

Detailed State Transition Dynamics

1. WAN Outage Detection:

   • While in Connected mode, the AP exchanges periodic CAPWAP Echo Request / Echo Response packets with the controller (default: 30-second interval). The AP can also utilize Fast Heartbeat (e.g., 1-second keepalive with 3-second timeout) for rapid failure detection.
   • When consecutive heartbeats time out, the AP declares the controller unreachable, logs a critical event, and transitions into Standalone mode.

2. Impact Across WLAN Profiles in Standalone Mode:

   • Centrally Switched WLANs: Because the CAPWAP Data tunnel to the central controller is severed, the AP cannot forward data frames. The AP immediately disassociates all clients connected to centrally switched WLANs and shuts down beaconing for those SSIDs. The SSIDs vanish from the air, preventing clients from attempting to connect to a non-functional network.
   • Locally Switched WLANs with Central Authentication:
     • Existing Clients: Clients that successfully completed 802.1X authentication before the outage continue transmitting and receiving traffic without interruption! The AP maintains their encryption keys (Pairwise Transient Keys [PTK]) in hardware and forwards their traffic onto the local access switch trunk.
     • New Clients & Roaming: Any new client attempting to associate, or an existing client that roams to an adjacent AP and must re-authenticate against Cisco ISE, will fail because the AP cannot reach the central RADIUS server across the severed WAN. (Note: If FlexConnect Local Auth fallback is configured, the AP can dynamically fall back to local authentication).
   • Locally Switched WLANs with Local Auth or PSK:
     • 100% Full Survivability. Existing client sessions are uninterrupted, newly arriving clients can authenticate (via local branch RADIUS or WPA2/WPA3 Pre-Shared Key), local DHCP servers assign IP addresses, and clients roam seamlessly between local branch APs using cached Pairwise Master Keys (PMKs).

3. Non-Disruptive Resynchronization upon WAN Recovery: When WAN connectivity is restored, the FlexConnect AP avoids disruptive reboots:

   • The AP initiates CAPWAP discovery and re-establishes its encrypted DTLS control tunnel to the Catalyst 9800 WLC.
   • The AP executes a Client Database Audit: it reports its active locally switched client table to the controller. The controller assimilates these sessions into its client tracking database without forcing clients to disconnect or re-authenticate.
   • The AP downloads any updated configuration deltas from the controller.
   • The AP re-enables beaconing for centrally switched WLANs and resumes streaming telemetry to Cisco Catalyst Center and Cisco Spaces.

---

4. Catalyst 9800 Configuration & Verification CLI

The following configuration demonstrates creating a Flex Profile, configuring VLAN mappings, applying FlexConnect ACLs, and converting an Access Point to FlexConnect mode:

! =========================================================================
! STEP 1: CONFIGURE FLEXCONNECT ACCESS CONTROL LISTS
! =========================================================================
C9800-01# configure terminal
ip access-list extended BRANCH_PREAUTH_ACL
 permit udp any any eq bootpc
 permit udp any any eq bootps
 permit udp any any eq domain
 deny ip any 10.0.0.0 0.255.255.255
 permit ip any any
exit

! =========================================================================
! STEP 2: CONFIGURE FLEX PROFILE WITH VLAN MAPPING AND NATIVE VLAN
! =========================================================================
wireless profile flex Branch-Flex-Profile
 native-vlan-id 10
 acl-policy
  acl-name BRANCH_PREAUTH_ACL
 exit
 vlan-name Corp-Data
  vlan-id 100
 vlan-name Branch-Guest
  vlan-id 200
 vlan-name POS-Retail
  vlan-id 300
exit

! =========================================================================
! STEP 3: CONFIGURE POLICY PROFILE FOR LOCAL SWITCHING
! =========================================================================
wireless profile policy Branch-Corp-Policy
 vlan Corp-Data
 no central-switching
 central-authentication
 central-dhcp
 no shutdown
exit

! =========================================================================
! STEP 4: CONFIGURE SITE TAG AND BIND FLEX PROFILE
! =========================================================================
wireless tag site Branch-Site-Tag
 flex-profile Branch-Flex-Profile
 no local-site
exit

! =========================================================================
! STEP 5: CONVERT AP OPERATIONAL MODE (CLI)
! =========================================================================
! Set AP operational mode to FlexConnect (requires AP reboot)
C9800-01# ap name AP-BRANCH-01 mode flexconnect

! Alternatively, set AP mode to Sniffer or Monitor:
! C9800-01# ap name AP-DIAG-01 mode sniffer
! C9800-01# ap name AP-DIAG-01 sniffer 11a 36 10.10.50.20

! =========================================================================
! STEP 6: VERIFICATION COMMANDS
! =========================================================================
! Verify AP operational mode and FlexConnect status
C9800-01# show ap name AP-BRANCH-01 config general | include Mode
! Expected Output: AP Mode : FlexConnect

! Verify Flex Profile VLAN mappings
C9800-01# show wireless profile flex detailed Branch-Flex-Profile

! Verify active client switching mode (Local vs Central)
C9800-01# show wireless client mac-address aaaa.bbbb.cccc detail | include Switching
! Expected Output: Local Switching : Yes