A customer must provide a secure wireless network from a Cisco Catalyst 9800 Series Wireless Controller to a Cisco AP to remote users. The corporate WLAN must be provided over the Internet to specific

Enabling Local Switching under the WLAN would forward user traffic directly to the local Internet without passing through the corporate network, which contradicts the requirement to deliver the corporate WLAN to remote users.

Configuring Remote LAN on the AP allows the AP's wired Ethernet port to connect wired devices - such as a locally-installed IP phone - back to the corporate network through the CAPWAP tunnel, which is a dedicated OEAP capability for supporting wired endpoints at the remote site.

Simply creating a Flex Group and adding the AP does not enable the Office Extend functionality; OEAP requires the specific 'Office Extend' option enabled on the Flex Profile, not just Flex Group membership.

Enabling Office Extend AP on the Flex Profile is the primary configuration that instructs the 9800 WLC to provision the AP as an OEAP, establishing a secure CAPWAP tunnel over the Internet to deliver corporate SSIDs to the remote location.

Configuring NAT on the physical interface is not a required step for OEAP deployment; the AP handles CAPWAP tunnel establishment to the WLC independently without requiring NAT configuration at the AP.