There's a limitation (stated below in Cisco's documentation) that FlexConnect ACLs in Cisco WLC cannot be combined in the same WLAN with local mode ACLs. The GUI allows the entry of a local mode ACL in the Interface tied to the WLAN and also a separate FlexConnect ACL in those APs that are in FlexConnect mode under the VLAN-Mappings section. This seems contrary to the restriction. Does the FlexConnect AP ignore the local mode ACL on the WLAN and just use its FlexConnect ACL or is the behavior something else to back up the statement below? I really don't want to have to create separate WLAN's just to handled the FlexConnect ACLs.

FlexConnect ACLs cannot be combined with Local mode ACLs on the same WLAN. If ACLs are needed for both FlexConnect and Local mode APs, you can apply two different WLANs to support the use of ACLs in both operating modes (one WLAN for FlexConnect APs and the other WLAN for Local mode APs).

Reference: Configuring FlexConnect in Cisco Wireless LAN Controller Configuration Guide, Release 7.2

  • Does the controller actually allow you to save the ACLs to config? I have a feeling it'll kick up a fuss once you try that.
    – user275
    May 26, 2013 at 8:57
  • If you mean save the ACLs to the WLC config, yes. If you mean push the FlexConnect ACL to the AP, I don't know. May 26, 2013 at 8:59
  • Ah yes, ignore me, I was being a muppet. Forgot ACLS are on the APs, not on the controller -.- I'll have a look, but I don't have anything on 7.2 at the moment, will see what happens on 7.3
    – user275
    May 26, 2013 at 11:24

1 Answer 1


I don't have anything on 7.2 still so I can't give you a definitive answer on your question. However, what I can say is that if you take the letter of the documentation as law and presume that you cannot combine FlexConnect and Local ACLs on a single WLAN, and you really don't want to create multiple WLANs, what I know you can do is use central switching on FlexConnect APs to apply local ACLs.

We actually do this for our Web Authenticated guest network. Yes, traffic on this network must transit back to the location of the WLC, but it was the best solution for us at the time of implementation.

  • Thanks, but I'm trying to do local switching for all but maybe one (guest) WLAN. May 28, 2013 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.