When a branch location loses connectivity, which Cisco FlexConnect state rejects new users but allows existing users to function normally?

In the `Authentication-Down/Switch-Local` state, the FlexConnect AP can no longer reach the central controller or the RADIUS server for new client authentications, leading to new users being rejected (`Authentication-Down`). However, because the AP is configured for local switching (`Switch-Local`), existing clients who are already authenticated can continue to pass traffic locally within the branch network without disruption.

`Authentication-Down/Switching-Down` would mean both new authentications are rejected and local data switching is also unavailable, meaning existing users would also lose connectivity.

`Authentication-Central` implies that authentication is still handled centrally, which contradicts the scenario of lost connectivity where central authentication would be unavailable.

`Authentication-Local/Switch-Local` would allow new users to authenticate locally if local EAP is configured on the AP, but the question states new users are *rejected*.