Edge Port: The Access Point Is Up, Its Clients Are Not
Power is fine and the AP is online. Its clients are stuck anyway. Find what the switch port does to their traffic, live, right below.
Symptom
A new FlexConnect access point is powered and online, and its wireless clients never get an address. The switch port is configured for the wrong kind of AP.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Create a free account to open Edge Port: The Access Point Is Up, Its Clients Are Not. You get the root cause and the full step-by-step fix.
No spam. The fix lands in your inbox too. Your account includes 5 guided labs free. After that, the Learning Pass unlocks every remaining lab.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A new access point on SW1 Gi1/0/12 powered up and joined the wireless controller, but employees on the corporate SSID (VLAN 20) never receive an IP address.
What you'll practice
- Read PoE state and class with show power inline
- Explain how local mode and FlexConnect local switching carry client traffic
- Configure an AP port as a trunk with the management VLAN native
- Limit the trunk to the VLANs the AP needs
The topology
SW1 Gi1/0/12 connects to a Cisco AP in FlexConnect mode with local switching. AP management is VLAN 99, the employee WLAN maps to VLAN 20.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show power inline GigabitEthernet1/0/12show interfaces GigabitEthernet1/0/12 switchportshow cdp neighbors GigabitEthernet1/0/12 detailTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why does the AP work while its clients do not?
The AP's own management traffic is untagged in VLAN 99, which the access port carries. Client traffic is switched locally onto VLAN 20 and tagged, and an access port drops tagged frames for other VLANs.
Would a local-mode AP need a trunk?
No. In local mode all client traffic is tunnelled to the controller inside CAPWAP, so an access port in the AP management VLAN is enough.
Can I run this on the lab's virtual switches?
The trunking part, yes. PoE cannot be emulated: the virtual switch images reject power inline commands, so the PoE output here follows Cisco's Catalyst documentation.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.