When a public-facing NAT IP address is configured on the Wireless LAN Controller's (WLC) management interface, the WLC's default behavior is to respond only to AP discovery and join requests destined for that NAT IP address. This configuration prevents APs on the internal network, which use the WLC's private management IP, from joining. The command config network ap-discovery nat-ip-only disable modifies this behavior, allowing the WLC to respond to join requests sent to both its internal management IP and its external NAT IP. This ensures that both internal APs and external OfficeExtend APs (OEAPs) can successfully associate with the same controller.

A. config flexconnect office-extend nat-ip-only disable: This command does not exist in the documented CLI. The nat-ip-only setting is a global network discovery parameter, not a FlexConnect-specific one.

B. config network ap-discovery nap-ip-only enable: This command contains a typo (nap-ip-only). If corrected to nat-ip-only enable, it would enforce the problematic behavior, forcing the WLC to respond only to the NAT IP.

C. config flexconnect office-extend nat-ip-only enable: This command does not exist. Even if it did, enabling a nat-ip-only feature would restrict, not expand, the WLC's responsiveness, failing to solve the issue for internal APs.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring the Controller for Network Address Translation" section: "If you have both internal and external access points

and you want them to be able to join the controller

you must disable the NAT-only setting by entering this command: config network ap-discovery nat-ip-only disable."

2. Cisco OfficeExtend Access Point Deployment Guide

"WLC Behind a NAT Device" section: "When the WLC is configured with a NAT IP address

the WLC sends its NAT IP address in the discovery response to the OEAP. ... If you have APs on the LAN side of the WLC

you must disable the 'AP discovery on NAT IP only' feature using the config network ap-discovery nat-ip-only disable CLI command."

3. Cisco AireOS Command Reference

"config network" commands: This reference documents the config network ap-discovery nat-ip-only {enable | disable} command

explaining its function is to control whether the controller responds to discovery requests on its management interface when a NAT IP is also configured. The disable option is specified for environments with both internal and external APs.