There are a couple of questions on design solution.
CAPWAP tunnel is created between the controller and the access points. The ends of the tunnel are the controller's "ap-management" interface and management interface of access point. I've discovered that having the AP and Controller in different L2 domains is best practice, but in theory this seems like a better solution. Which is correct?
One of the wireless networks will be the guest WI-FI. A secretary will create access attributes. Is it require to create an additional interface (in corporate network) on the controller and give credentials to "Lobby Admin" to implement such a scheme?