Split Tunneling must be configured for traffic sent by the client to be classified based on packet content, using an ACL. To accomplish this, the packets must be either locally switched from Cisco Fle

Interface ACLs are applied to Layer 3 interfaces on routers and switches to permit or deny traffic flows - they have no role in FlexConnect switching decisions.

CPU ACLs protect the WLC control plane from high-rate traffic destined to the CPU and are unrelated to data-plane switching decisions on FlexConnect APs.

A FlexConnect ACL is applied directly to the FlexConnect AP and uses permit/deny rules to inspect packet content, directing matched traffic to either local switching (forwarded directly to the local LAN) or central switching (encapsulated over CAPWAP back to the WLC). This per-packet classification is the mechanism that enables split tunneling in FlexConnect deployments and cannot be achieved with any other ACL type in AireOS.

WLAN ACLs apply access control policies to all traffic on a given WLAN for security filtering purposes but do not provide the per-packet local-versus-central switching logic required for FlexConnect split tunneling.