An access point, comprising: a processing resource; and a memory resource storing machine-readable instructions to cause the processing resource to: assign a first tunnel tag to a first DHCP profile of a client device, the first tunnel tag identifying a primary VLAN tunnel to a first network controller of a first data center; assign a second tunnel tag to a second DHCP profile of the client device, the second tunnel tag identifying a secondary VLAN tunnel to a second network controller of a second data center; determine whether the primary VLAN tunnel to the first network controller is inactive based on a number of detected access failures; and connect the client device to the secondary VLAN tunnel in response to determining that the primary VLAN tunnel is inactive.