A wireless access point mounted in a new hospital clinic wing associates clients successfully, but every client that connects to the staff SSID ends up unable to reach any campus resources, while the same AP's guest SSID works normally. The technician confirms the AP's wired uplink port on the switch has only the guest VLAN in its allowed-VLAN list. What is the fault?
Select an answer to reveal the explanation.
Short Explanation
Clients happily joining the staff SSID but going nowhere afterward tells you the radio side is fine, the problem is downstream on the wire. If the AP's uplink port only allows the guest VLAN across, then staff traffic tagged for its own VLAN simply never makes it past that port. Add the staff VLAN to the port's allowed list and that traffic finally has a path.
Full Explanation
An access point commonly trunks multiple VLANs, one per SSID, back to its switch port, tagging client traffic according to which SSID it arrived on; the switch port on the wired side must have all of those VLANs included in its allowed-VLAN list for that traffic to actually cross onto the wired network. Here, clients successfully associate to the staff SSID, which proves the radio, SSID broadcast, and client authentication are all functioning, but their traffic then has nowhere to go because the switch port is only permitting the guest VLAN, so staff-tagged frames are dropped right at that trunk boundary. This matches the description precisely: association succeeds, but nothing beyond the AP works for that SSID specifically. A disabled radio would prevent clients from associating to the staff SSID at all, which contradicts the fact that clients are successfully connecting. An incompatible WPA version would typically prevent successful association or authentication in the first place, not allow a client to join and then fail purely at the point of reaching campus resources. Insufficient PoE power would tend to affect the AP's overall operation, including both SSIDs and possibly the radios themselves, rather than selectively breaking only one SSID's onward connectivity while the other functions normally. A concrete check is adding the staff SSID's VLAN to the switch port's allowed-VLAN list and confirming the AP's SSID-to-VLAN mapping matches what the wired network expects.