Hi So basically we are a hospitals with 3 large campuses. We have mobility anchors to 4 different organisations.   We can roam in their buildings and they can roam in our buildings via Mobility Anchor as we are all using Cisco WLCs. We also have Cisco WLC on DMZ for guest access.   Each Organisation has a separate Firewall between us and them.   So a CAPWAP tunnel is created between ours and their WLCS to allow us and them to proxy the authentication for wireless and they break out on their WLCs.  It's clean and tidy. All APs are in local mode do all go back to the WLC   Looking at Meraki the APs break on out on the switch.  So guessing each SSID we use, will be on it's on vlan and connect to the vpn connector, which would then create a VPN between these and the organisations firewalls?   So from the AP to the VPN Connector this traffic will be on our LAN and could be accessed.   Just trying to get a better understanding, if company decide to migrate to Meraki for new buildings.   cheers     ... View more