A hotel runs local-mode access points. The guest VLAN was added on the access-point switch ports and was not added on the controller uplink. Guest clients associate and never get an address. Where does that VLAN have to exist?
Select an answer to reveal the explanation.
Short Explanation
Local mode ships the guest frames to the controller, like a shuttle that only stops at headquarters. Your VLAN has to be waiting there, on the controller uplink, not only on the access-point port. The access point is not bridging that guest VLAN itself.
Full Explanation
In local mode, client data is CAPWAP-tunneled to the wireless controller, and the client VLAN is terminated on the controller side. The access-point switch port is typically a single access VLAN for the access point's own management address. Adding the guest VLAN only on that port does not put guest DHCP where the tunneled clients arrive, so they associate and never get an address. The VLAN has to exist on the controller uplink, with a path to the guest DHCP server. Bridging guests on the access-point port is FlexConnect local switching, not local mode. The hotel's access points are not bridging the guest VLAN there. Mesh backhaul is a different architecture. Local-mode access points are wired, and they do not forward guest traffic over a root radio. A sniffer analyzer receives copies of 802.11 frames from an access point that was placed in sniffer mode. It is not the DHCP server for local-mode guests. Exam caveat: the policy profile still has to map the guest WLAN to that VLAN. A VLAN that exists on the uplink and is never named in the policy profile will not be used. Operational check: confirm the guest VLAN is up on the controller uplink, the policy profile names it, and a test guest receives a guest-scope address.