In a scenario with a lot of Broad- and Multicast traffic a switch to the mode "LAN at AP" is recommended.

As of LCOS 10.34 Rel the handling of Broad- and Multicast packets in the LAN bridge was fixed. In earlier Firmware versions no communication between end devices within a WLC-Tunnel was possible, if they were connected to different access points (the total number of Broad- and Multicast packets is derived from the number of Broad- and Multicast packets multiplied with the number of access points which broadcast the SSID associated with a WLAN-Tunnel).

This leads to an increased base load of Broad- and Multicast packets in a WLC-Tunnel and therefore also to an increased CPU load on the WLAN Controller.

If the scenario was functional up to LCOS 10.34, it could be sufficient to use a virtual WLAN-Controller (vRouter). Depending on the used hardware and assigned ressources for the vRouter VM, this can be significantly more performant than a regular WLAN-Controller.

Additionally it is recommended to deactivate the option Allow data traffic between stations of this SSID in the logical WLAN network, if no communication between the end devices is necessary.

The CPU load increases when more WLC-Tunnels are used.

The number of WLC-Tunnels should be reduced and a WLC-Tunnel should only be used for individual SSIDs, e.g. for the Public Spot SSID.

The CPU load increases when more end devices are connected via a WLC-Tunnel.

Scenarios with many end devices should be implemented via "LAN at AP" instead of a WLC-Tunnel.

The CPU load increases when more access points broadcast an SSID via a WLC-Tunnel.

SSIDs with a WLC-Tunnel should only be broadcasted on access points, where this SSID is needed. This SSID should be removed from all other access points.

If a WLC-Tunnel is linked with a LAN interface via a bridge group, this leads to a greatly increased cpu load. Therefore this has to be avoided at all costs!

Traffic should be routed to the next router or directly to the Internet (Step 3. Setting up Internet connectivity).

If a WLC-Tunnel is linked with another WLC-Tunnel via a bridge group, this leads to a greatly increased cpu load and can also lead to complete utilization of the WLAN Controller. Therefore this has to be avoided at all costs!

The use of "LAN at AP" instead of a WLC-Tunnel for such a scenario is mandatory.

As of LCOS 10.32 the MAC address of a connected WLAN device connected via a WLC-Tunnel is not tracked, if the WLC-Tunnel is assigned directly to the IP network. Thus replies to the WLAN device have to be sent to all access points, the WLC-Tunnel is connected to. This leads to an increased CPU load and especially a highly increased network load. 

As the LAN brige tracks the MAC addresses of connected devices, the WLC-Tunnel can be assigned to a Bridge group and the Bridge group is assigned to the respective IP network. Please note, that in this case only a single WLC-Tunnel can be included in a Bridge group.