A city library WLAN must keep user VLANs centralized on the wireless controller rather than switching locally at each AP. Which architecture pattern best meets that design goal?

A city library WLAN that must keep user VLANs centralized on the wireless controller rather than switching locally at each AP should tunnel AP client traffic to the controller in a CAPWAP-style architecture so user VLANs terminate centrally. Central termination lets VLAN assignment, ACLs, and consistent policy live where librarians and network staff expect them, instead of depending on every closet switch and AP to implement the same local bridging decisions. That pattern matches controller-centric civic designs for consistent guest and staff segmentation across branches. Advertising every client VLAN as an SSID name so APs can “pick locally” does not centralize VLAN termination and creates operational sprawl. Disabling encryption so VLANs supposedly become unnecessary abandons confidentiality without achieving centralized policy. Bridging guest SSIDs only to printer VLANs at each branch switch is a local hack that neither centralizes user VLANs nor safely isolates patrons from other building resources. Exam caveat: tunneling concentrates traffic and failure domains on the controller path—capacity, QoS, and WAN links between APs and controllers must be sized accordingly for busy library hours. Operational check: associate a test client on a branch AP, verify its VLAN appears at the controller or central switch rather than only as a locally bridged VLAN on the access switch, and confirm policy counters increment at the central enforcement point.