Branch wireless users report that they can no longer access services from head office but can access services locally at the site. New wireless users can associate to the wireless while the WAN is…

Authentication-central/switch-local requires the WLC to handle authentication, which is unavailable when the WAN link is down.

Standalone mode is the FlexConnect state that activates when the AP loses connectivity to the WLC - the AP continues to service clients using cached configuration without the controller.

Authentication-central/switch-central requires both authentication and data switching through the WLC via the WAN tunnel, which is not possible in this scenario.

WPA2 Personal (PSK) uses a locally stored pre-shared key, allowing the AP to authenticate new clients entirely without contacting the WLC or a RADIUS server, which explains why new users can still associate while the WAN is down.

Authentication-local/switch-local is the FlexConnect operation mode active in standalone mode with PSK - the AP performs the authentication itself and also locally switches client data traffic, consistent with local service access but no head-office reachability.

WPA2 Enterprise requires a RADIUS server (typically reachable only via the WAN) to authenticate clients; new clients could not associate if WPA2 Enterprise were in use with the WAN down.