Abstract: Techniques to perform an operation comprising determining, by a local area network (LAN) controller, that a first device has connected to a predefined service set identifier (SSID) of a first wireless access point (AP), of a plurality of wireless APs, receiving, by the LAN controller from the first device, an Extensible Authentication Protocol (EAP) response specifying a destination address of a first private LAN controller associated with a first private network, creating, by the LAN controller based on the destination address, a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel between the first wireless AP and the first private LAN controller, and configuring, by the LAN controller, the first wireless AP to broadcast a private SSID associated with the first private network, wherein the first device accesses the first private network via the CAPWAP tunnel by connecting to the first wireless AP using the private SSID.

Abstract: Techniques to perform an operation comprising determining, by a local area network (LAN) controller, that a first device has connected to a predefined service set identifier (SSID) of a first wireless access point (AP), of a plurality of wireless APs, receiving, by the LAN controller from the first device, an Extensible Authentication Protocol (EAP) response specifying a destination address of a first private LAN controller associated with a first private network, creating, by the LAN controller based on the destination address, a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel between the first wireless AP and the first private LAN controller, and configuring, by the LAN controller, the first wireless AP to broadcast a private SSID associated with the first private network, wherein the first device accesses the first private network via the CAPWAP tunnel by connecting to the first wireless AP using the private SSID.