A remote branch must connect its AP/controller WLAN path across the public Internet back to headquarters. Which protection best fits that untrusted WAN transit?

A remote branch that must connect its AP or controller WLAN path across the public Internet back to headquarters should protect that untrusted WAN transit with an IPsec tunnel. Infrastructure control and data channels between branch APs and central controllers are high-value targets; encrypting and authenticating them across the Internet is baseline municipal WAN hygiene. Cleartext CAPWAP-style transport over the public network can expose management information and, depending on design, user traffic that the city believes is only “inside” its WLAN architecture. Sending CAPWAP-style control and data in cleartext merely to save CPU is an unacceptable trade for Internet transit between civic sites. Relying on the branch guest PSK as WAN encryption for infrastructure tunnels confuses a user SSID secret with site-to-site protection. Advertising branch management subnets in public BGP without a tunnel exposes management reachability on the open Internet. Exam caveat: IPsec designs need key management, rekey monitoring, and failover testing—an unmonitored tunnel that drops can take the entire branch WLAN offline during business hours. Operational check: bring up the branch AP or controller path over IPsec, confirm encapsulation with outer ESP or equivalent, verify WLAN clients still authenticate centrally, and fail the tunnel briefly in a maintenance window to validate alerting and backup behavior.