If a FlexConnect branch loses controller connectivity, which state denies new client authentication but keeps already connected clients active?

When a FlexConnect Access Point (AP) loses connectivity to its Wireless LAN Controller (WLC), it enters a standalone mode. In this mode, the AP can operate in different states depending on its configuration and the services it can provide. The "Authentication-Down/Switch-Local" state means that the AP cannot reach the WLC for centralized authentication services (Authentication-Down), therefore new client authentications are denied. However, the AP continues to switch data traffic locally for clients that were already connected before the WLC link failed (Switch-Local). This ensures minimal disruption for active users. "Authentication-Down/Switching-Down" would mean both authentication and local switching are disabled, which is not the behavior described. "Authentication-Central/Switch-Local" implies central authentication is still available, which contradicts the loss of WLC connectivity. "Authentication-Local/Switch-Local" would mean the AP is performing local authentication, which is a different FlexConnect capability not directly related to the denial of new authentications due to WLC loss.