Guest phones associate at a branch and then fail. The mobility tunnel to the anchor controller is up. The guest WLAN exists on the branch and does not exist on the anchor. What is missing on the anchor?
Select an answer to reveal the explanation.
Short Explanation
The tunnel is open and the far end has never heard of the guest network. Your branch can start the session and the anchor cannot finish it. Create the guest WLAN on the anchor, and a capture mode will not invent that WLAN.
Full Explanation
A guest anchor finishes the guest session on the anchor controller. The branch can associate the phone and still fail if the anchor does not have the guest WLAN, which is this case. The mobility tunnel is already up, so the missing piece is the WLAN on the anchor, not the tunnel. An up tunnel is not evidence the anchor is refusing guests for lack of a path. Sniffer mode does not create a WLAN. The employee SSID, hidden or not, is not a substitute for the guest WLAN on the anchor. Guests associate on the foreign controller and fail because the anchor controller does not have the guest WLAN. The mobility tunnel itself is up. Check one live client after the change and leave the rest of the floor alone until that client matches the result you expected. Exam caveat: the WLAN on the anchor has to agree with the branch on the security and the VLAN the anchor will use. A WLAN that exists and points at a dead VLAN fails one step later. Operational check: create the guest WLAN on the anchor, associate a test phone at the branch, and confirm the session lands on the anchor.