Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

FlexConnect + bridge mode

Updated: April 10, 2026

Want to summarize with AI?

Covers resilient mesh deployments using FlexConnect and bridge-mode APs, including configuration of flex profiles, site tags, mesh profiles, AP associations, and verification for enhanced redundancy.

A FlexConnect bridge mode is a wireless network configuration that

enables FlexConnect capabilities on mesh (bridge mode) APs,
allows mesh APs to inherit VLANs from the root AP, and
supports VLAN trunking and native VLAN ID configuration per AP.

FlexConnect + bridge mode enables FlexConnect capabilities on mesh (bridge mode) APs. Mesh APs inherit VLANs from the root AP to which they are connected.

Any EWC-capable AP in FlexConnect mode connected to a MAP should be in CAPWAP mode (AP-type CAPWAP).

You can enable or disable VLAN trunking and configure a native VLAN ID on each AP for any of these modes:

FlexConnect
FlexConnect + bridge (FlexConnect + mesh)

Flex resilient with Flex and bridge modes

A flex resilient system in flex and bridge modes is a network feature that

operates within a configuration involving both flex and bridge mode APs
allows the primary functionality of APs as mesh links between a root access point (RAP) and mesh access point (MAP), and
ensures that the feature's operations are limited to flex and bridge mode APs.

Additional reference information

Flex+Bridge Mode: A configuration mode combining the flexibility of standalone (local) management for APs with stable mesh network connectivity through root and mesh APs.
Mesh Link Operation: Exists between RAP and MAP, allowing communication and bridging.
Client Connectivity:
- No new or disconnected clients can associate with a Mesh AP in flex+bridge mode.
- Ongoing connections are maintained until a loss of the parent link for a child MAP.

In a locally switching WLAN, the client traffic of a Flex+Bridge MAP is sent to the RAP's switchport.
A child MAP that loses its parent connection cannot connect to a new parent without reacquiring a connection to the CAPWAP controller.

The feature does not operate on non-Flex+Bridge mode APs.
A new or disconnected wireless client cannot associate with a Mesh AP when in this mode.

Configure a flex profile (GUI)

Set up a flex profile to enhance network resilience and enable local authentication.

Use these steps to configure a flex profile using the GUI.

Procedure

	1.	Choose Configuration > Tags & Profiles > Flex.
	2.	Click a Flex Profile Name. The Edit Flex Profile dialog box appears.
	3.	Under the General tab, choose the Flex Resilient check box to enable the Flex Resilient feature.
	4.	Under the VLAN tab, choose the required VLANs.
	5.	(Optionally) Under the Local Authentication tab, choose the desired server group from the Local Accounting RADIUS Server Group drop-down list. Also, choose the RADIUS check box.
	6.	Click Update & Apply to Device.

The flex profile is successfully configured and updated in the system.

Configure a Flex profile (CLI)

Configure a Flex Profile using commands on a network device to enable specific features and settings.

Use these steps to configure a flex profile using the CLI.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a flex profile and enters flex profile configuration mode using the wireless profile flex flex-profile command. Example: `Device(config)# wireless profile flex new-flex-profile`
	3.	Enable ARP caching. Example: `Device(config-wireless-flex-profile)# arp-caching`
	4.	Enable default parameters for the Flex profile using the description description command. Example: `Device(config-wireless-flex-profile)# description "new flex profile"`
	5.	Configure native vlan-id information. Example: `Device(config-wireless-flex-profile)# native-vlan-id 2660`
	6.	Enable the resilient feature. Example: `Device(config-wireless-flex-profile)# resilient`
	7.	Configure VLAN name using the vlan-name vlan_name command. Example: `Device(config-wireless-flex-profile)# vlan-name VLAN2659`
	8.	Configure the VLAN ID. Example: `Device(config-wireless-flex-profile)# vlan-id 2659` The valid VLAN ID ranges from 1 to 4096.
	9.	Exit the configuration mode and return to the privileged EXEC mode. Example: `Device(config-wireless-flex-profile)# end`

The Flex profile is configured on the network device with the specified settings and features.

Configure a site tag (CLI)

Configure a site tag on a network device to manage wireless networks efficiently and map APs to specific site tags.

Use these steps to configure a site tag using CLI.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a site tag and enter site tag configuration mode using the wireless tag site site-name command. Example: `Device(config)# wireless tag site new-flex-site`
	3.	Configure a flex profile using the flex-profile flex-profile-name command. Example: `Device(config-site-tag)# flex-profile new-flex-profile`
	4.	Remove Local site configured from the site tag. Example: `Device(config-site-tag)# no local-site`
	5.	Map a site tag to an AP using the site-tag site-tag-name command. Example: `Device(config-site-tag)# site-tag new-flex-site`
	6.	Exit configuration mode and return to privileged EXEC mode. Example: `Device(config-site-tag)# end`

The site tag is configured and mapped to the specified AP, facilitating effective management of wireless networks within the defined site tag.

Configure a mesh profile (CLI)

Configure a mesh profile on a network device to enable communication between mesh nodes, ensuring VLAN awareness and connectivity management.

Use these steps to configure a mesh profile using CLI commands.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a mesh profile and enter the mesh profile configuration mode using the wireless profile mesh profile-name command. Example: `Device(config)# wireless profile mesh Mesh_Profile`
	3.	Disable VLAN transparency to ensure that the bridge is VLAN aware. Example: `Device(config-wireless-profile-mesh)# no ethernet-vlan-transparent`
	4.	Exit the configuration mode and return to the privileged EXEC mode. Example: `Device(config-wireless-profile-mesh)# end`

The mesh profile is configured, VLAN transparency is disabled to ensure VLAN awareness, and the device returns to privileged EXEC mode.

Associate the wireless mesh to an AP profile (CLI)

Associate a wireless mesh to an AP profile to ensure proper configuration and management of AP.

Use these steps to associate the wireless mesh to an AP profile.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the AP profile and enter AP profile configuration mode using the ap profile ap-profile-name command. Example: `Device(config)# ap profile new-ap-join-profile`
	3.	Configure the mesh profile in AP profile configuration mode using the mesh-profile mesh-profile-name command. Example: `Device(config-ap-profile)# mesh-profile Mesh_Profile`
	4.	Configure the Secure Shell (SSH). Example: `Device(config-ap-profile)# ssh`
	5.	Specify the AP management username and password for managing APs using the mgmtuser username username password {0 \| 8} password command. Example: `Device(config-ap-profile)# mgmtuser username Cisco password 0 Cisco secret 0 Cisco` 0 : Specifies an UNENCRYPTED password. 8 : Specifies an AES encrypted password. Note While configuring a username, ensure that special characters are not used as they can lead to configuration errors.
	6.	Exit configuration mode and return to privileged EXEC mode. Example: `Device(config-ap-profile)# end`

The AP profile is configured with the wireless mesh, allowing for proper management and operation of the AP.

Attach site tag to an access point (CLI)

Attach a site tag for AP identification and configuration management.

Use these steps to attach a site tag to an AP:

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure APs and enters ap-tag configuration mode using the ap mac-address command. Example: `Device(config)# ap F866.F267.7DFB`
	3.	Map a site tag to the AP using thesite-tag site-tag-name command. Example: `Device(config-ap-tag)# site-tag new-flex-site` Note Associating Site Tag causes the associated AP to reconnect.
	4.	Exit configuration mode and return to privileged EXEC mode. Example: `Device(config-ap-tag)# end`

The AP is now associated with the specified site tag and will reconnect.

Configure switch interface for APs (CLI)

Configure a switch interface for APs using CLI to ensure proper VLAN assignment and trunk settings.

Use these steps to configure switch interface for APs:

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Enter the interface to be added to the VLAN. Example: `Device(config)# interface <int-id>`
	3.	Assign the allowed VLAN ID to the port using the switchport trunk native vlan vlan-id command. Example: `Device(config-if)# switchport trunk native vlan 2660`
	4.	Assign the allowed VLAN ID to the port using the switchport trunk allowed vlan vlan-id command. Example: `Device(config-if)# switchport trunk allowed vlan 2659,2660`
	5.	Sets the trunking mode to trunk unconditionally. Example: `Device(config-if)# switchport mode trunk` Note When the controller works as a host for spanning tree, ensure that you configure portfast trunk, using spanning-tree portfast trunk command, in the uplink switch to ensure faster convergence.
	6.	Exit configuration mode and return to privileged EXEC mode. Example: `Device(config-if)# end`

The switch interface is successfully configured for AP connectivity, enabling effective VLAN management and ensuring faster network convergence for connected APs.

Flex resilient with flex and bridge mode AP configuration verification

Use the verification commands to view details about AP mode and model, MAP mode details, RAP mode details, and the status of the Flex Profile—Resilient feature.

Use this command to view details about the AP mode and model.

Device# show ap name <ap-name> config general | inc AP Mode
AP Mode                                         : Flex+Bridge
AP Model                                        : AIR-CAP3702I-A-K9

Use this command to view the MAP mode details.

Device# show ap name MAP config general | inc AP Mode
AP Mode                                         : Flex+Bridge
AP Model                                        : AIR-CAP3702I-A-K9

Use this command to view the RAP mode details.

Device# show ap name RAP config general | inc AP Mode
AP Mode                                         : Flex+Bridge
AP Model                                        : AIR-AP2702I-A-K9

Use this command to check the status of the Flex Profile—Resilient feature.

Device# show  wireless profile flex detailed FLEX_TAG | inc resilient
Flex resilient                 : ENABLED

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

FlexConnect + bridge mode

Flex resilient with Flex and bridge modes

Additional reference information

Configure a flex profile (GUI)

Procedure

Configure a Flex profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure a site tag (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Configure a mesh profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Associate the wireless mesh to an AP profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Attach site tag to an access point (CLI)

Procedure

Example:

Example:

Example:

Example:

Configure switch interface for APs (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Flex resilient with flex and bridge mode AP configuration verification