An engineer set up a local authenticated Cisco FlexConnect AP with a guest LAN. Guests report not being able to authenticate. Which configuration must be changed on the WLAN for guests to be able to a

AAA override allows per-user VLAN or QoS policy assignment based on RADIUS attributes, but it does not change where or how initial authentication occurs for guests.

RADIUS NAC (Network Admission Control) integrates posture assessment into the authentication process, but it does not resolve the fundamental issue of authentication being performed locally rather than centrally.

When a FlexConnect AP is set to local authentication, it attempts to authenticate users against a local database or a RADIUS server reachable directly from the branch, which is not suitable for a guest WLAN where authentication is managed centrally. Enabling central authentication causes the AP to tunnel authentication traffic back to the Cisco WLC, which then forwards it to the central RADIUS or guest anchor infrastructure. This allows guest credentials to be validated correctly through the centralized authentication system.

Configuring a backup RADIUS server provides redundancy for an existing authentication path but does not resolve the root cause, which is that the AP is set to local authentication mode rather than central authentication.