A tunneled SSID sends the relevant wireless user traffic to a gateway cluster, where the gateway can evaluate its stateful role-based policies. Confirm that the client's role is assigned at authentication, that the correct rules are installed at the gateway, and that user VLANs terminate on the cluster. Bridged forwarding keeps the datapath local, so policies on a remote gateway cannot inspect those frames. Mixed mode may tunnel selected VLANs, but the simple and unambiguous choice for all affected users is tunneled forwarding. If gateway inspection is mandatory for every client in the given role, mixed forwarding introduces an avoidable bypass condition because a locally bridged VLAN can avoid the gateway datapath.
Microbranch patterns provide selective site forwarding but do not automatically place every target session in the gateway datapath. Mixed mode can bridge some clients locally, bypassing centralized inspection. Tunnel mode makes gateway-side enforcement the explicit default path.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit