Local Versus Tunneled Forwarding on a Multi-Floor Campus
A retail headquarters has six floors and 180 APs. An ArubaOS 8 Mobility Conductor pair manages two Mobility Controllers in the data center. The corporate SSID uses 802.1X and should break out locally on each floor; the guest SSID must be tunneled to a DMZ controller. Each floor has user VLANs 110-160 and an AP management VLAN 900. AP switch ports are trunked with VLAN 900 untagged and user VLANs tagged. DHCP option 43 points APs to the controller IPs. A new floor opens; its APs join, but corporate clients receive VLAN 900 addresses instead of floor VLANs.
1. Identify the most likely configuration cause and explain the forwarding and VLAN design that should be used for corporate and guest traffic.
Read the worked answer
The symptom points to a VLAN assignment problem in the virtual AP or AP group, not an AP discovery problem. If corporate clients land in VLAN 900, the corporate VAP is either bridged on the AP's native VLAN or its named VLAN is not resolving to the floor VLAN. With local forwarding, the AP must have a trunk that carries the client VLAN tagged and must map the VAP to that VLAN. Because all six floors share one controller pair, a single corporate VAP with one VLAN cannot serve different floor VLANs correctly unless the VLAN is assigned per AP group or per AP.
Recommended design: Create one AP group per floor, or use per-AP VLAN assignment if operations require it. In each floor AP group, bind the corporate VAP to that floor's user VLAN (110-160) with local forwarding. Keep the AP management VLAN 900 untagged and separate from client traffic. Bind the guest VAP to the DMZ controller with tunneled forwarding and a dedicated guest VLAN and firewall policy there. This preserves local breakout for corporate traffic while centralizing guest egress and policy.
2. Describe how you would structure AP groups, virtual APs, and VLAN name mappings so the design scales to new floors.
Read the worked answer
Use a naming convention that ties each object to its floor and purpose: AP group HQ-F3, virtual AP CORP-F3, and VLAN name VLAN-113. Each floor AP group contains the corporate VAP with local forwarding and the floor VLAN, plus the common guest VAP tunneled to the DMZ controller. Define VLAN names centrally on the Mobility Conductor, but assign the actual VLAN ID in the AP group or AP system profile so the same VAP profile can be reused without hard-coding one floor's VLAN everywhere.
For scale, keep the corporate VAP profile identical across floors except for the VLAN binding, and use configuration templates or group inheritance so a new floor is a copy-and-change operation. Ensure the AP switch port is trunked with VLAN 900 untagged and all user VLANs tagged. Validate name resolution with show ap vlan or the equivalent VLAN-name table; if a named VLAN is missing, clients fall back to the native VLAN and reproduce the original symptom.
3. What verification steps would you perform on the new floor before declaring the deployment complete?
Read the worked answer
Verify from the bottom up. Confirm the AP is in the intended AP group and is receiving the correct VAP set. Confirm the switch port is trunked with VLAN 900 untagged and VLANs 110-160 tagged. On the controller, check the user table for a corporate test client: it should show the floor VLAN, the correct role, and the correct forwarding mode. Check that a guest test client is tunneled to the DMZ controller and receives a guest subnet address.
Then test DHCP and policy: corporate client gets an address from the floor DHCP scope and can reach a clinical or business application; guest client cannot reach internal subnets. Repeat after an AP reboot to confirm the configuration persists and the AP rejoins the correct group. Finally, compare the new floor's configuration against an existing floor with a diff of AP group, VAP, and VLAN assignments; any unintended difference is a likely future outage.