I know is an old thread but the way to make it work, like you said is config vlan mapping in the flexconnect group
In my setup the vlan 102 is used for the APs and 103 is used for the clients. The switch port has the 102 as native/untagged and the 103 as tagged/trunked
Hope this helps, it took me a little while to find the solution and how to do it since I don't manage Cisco's wlc
------------------------------
Ulises Cazares
------------------------------
Original Message:
Sent: Nov 03, 2015 05:35 AM
From: Ryan Evans
Subject: 802.1x with Cisco WLC unable to change VLAN
Hi
I have done this in the past but it was a little while ago. When responding you need to make sure that you are sending the correct attributes back and that the VLAN exists on the access point. If the vlan is not defined on the access point then it does not know how to handle it.
If I remember correctly it was a matter of adding the additional vlans to the AAA-VLAN ACL section under the Flex-Connect Group. You can leave the ACL section blank and just add the VLAN's. I believe there is a maximum of 12 VLAN's on a Flec-Connect AP as well.
Thanks