Branch wireless users report that they can no longer access services from head office but can access services locally at the site. New wireless users can associate to the wireless while the WAN is dow

In standalone mode with no WLC reachability, FlexConnect APs fall back to authentication-local/switch-local operation - they authenticate clients against locally cached credentials and switch traffic directly onto the local network without requiring the WLC, which is why local services remain accessible while head office services are not.

WPA2 Personal (pre-shared key) is the authentication method that allows new clients to associate during standalone mode because the PSK is stored locally on the AP and does not depend on a RADIUS server or WLC that would be unreachable across the downed WAN link.

Authentication-central/switch-central requires the AP to forward client authentication requests and data traffic to the WLC over the WAN - this is impossible when the WAN link is down and would prevent any new client associations.

Lightweight mode requires a continuously active CAPWAP control channel to the WLC for all management functions - an AP operating in lightweight mode cannot serve clients independently when WLC reachability is lost.

When a FlexConnect AP loses its CAPWAP tunnel to the WLC due to WAN failure, it automatically transitions to standalone mode, enabling it to independently manage client associations and local traffic switching using its locally stored configuration.

Web authentication requires client traffic to be redirected to a captive portal server or the WLC itself for credential validation, both of which are unreachable across a downed WAN link, making web auth incompatible with FlexConnect standalone operation.