An engineer must deploy FlexConnect APs to a branch office. If the connection to the WLC fails and 802.1X authentication is available, users must stay connected to the AP. Which FlexConnect state…

Authentication Central/Switch Central tunnels both authentication and data to the WLC, so any WLC connectivity failure immediately drops all clients with no local fallback.

Authentication Local/Switch Local means the FlexConnect AP performs 802.1X authentication against a locally stored credential cache and switches client traffic locally without tunneling to the WLC. When the WLC connection is lost and the AP enters standalone mode, this configuration allows clients to re-authenticate and maintain connectivity because neither authentication nor data switching depends on the WLC being reachable.

Authentication Central/Switch Local locally switches data but still depends on the WLC for 802.1X authentication, meaning clients cannot authenticate when the WLC link fails.

Authentication Local/Switch Central allows local authentication but tunnels client data to the WLC, so traffic cannot flow if the WLC connection is unavailable, making this unsuitable for branch resiliency.