Auto assign vlan for Wireless AP 1142

Hi,
Instead of statically assigning a vlan to a switch port where the AP is connected, is there a way to use 802.1x or NAC to assign the right vlan to an AP itself (not the clients)?

You should be able to do this if you setup switchport authentication on the switch the AP is connecting to and have the IETF attribuiles 64, 65, and 82 passed down from the Radius server.

Similar Messages

Separate vlan for wireless voice

Hi all, I'm about to embark on reconfiguring my home lab, at present I have just 2 vlans which are for VoIP and data, I'm going to split my network so I have the following:
Data VLAN for our home PC's
Voice VLAN for phones
1 wireless VLAN for home laptops
1 wireless VLAN for games consoles
1 wireless guest access so I don't have to give out my own ssid credentials
1 Management VLAN
My question is do I have a separate VLAN for wireless VOIP or do I just use the same Voice VLAN?
Regards
Martyn
Sent from Cisco Technical Support iPad App

Martyn:
Both solutions are valid. You can use the current voice VLAN or create a new VLAN.
If you create a new VLAN you need to apply needed QoS to wired side as well.
If your current Voice VLAN is already configured for QoS then using it for wirelss voice is easier.
So the preffered option is to use your current voice VLAN for wireless voice as well.
HTH
Amjad

Criticial VLAN for Wireless Users

Hi
I have a setup were all users (LAN & WIRELESS) Are being authenticated using Dot1x with ACS
In case of ACS failure (without a secondary one), I know i can configure the switch port on the LAN to have a critical VLAN, so in case ACS was detected as Dead, a new user being authenticated is assigned to the Critical VLAN,
Is there any Similar solutions for users connecting through the wireless connection? Can we do a critical VLAN in case of ACS Failure, or anything similar to it? knowing that there is a WLC in the setup with Light weight access points.
Thanks
Best regards,

Hello,
Since in wireless network, the Radius server has an active part in the encryption key derivation, the WLC can't just grant network access to the end client when the radius server is down, as the client wouldn't have the necessary keying material (nor the WLC as well).
The best option would be to either have multiple radius servers, or to make the WLC act as a radius server and use it as a backup method, so that if your radius server is down, your WLC will handle the radius request and generate the keying material. The issue is that you will need to have a consistent user database on the WLC.
The easiest way would be to have a separate SSID with legacy WPA/WPA2 that are pre configured on clients computer, and allow network access to this SSID only when the primary SSID with Dot1x is down. This can be done manually, or on the layer 3 gateway using PBR/EEM...
For example with PBR, you can set output interface to null0 from traffic originating from the WPA SSID, only of Radius server is reachable, otherwise let the traffic flow.

Can router dhcp different addresses to different vlans for wireless clients

is it possible for the router to hand out different ip's to wireless clients on different vlans?

Yes, the router needs to have a dhcp pool on each subnet and have an "interface Vlan x" for each vlan. It will then assign ips to clients in different vlans.
One vlan per SSID.

VLANs for Wireless LAN controller

Hello,
Just finished the configuration of wireless controller and connected Access point.
I have a scheme like this:
Cisco 3945 with WLC on SRE------TRUNK-------L3 switch-------TRUNK----------L2 switch--------ACCESS PORT-------ACCESS POINT-----WIRELESS----CLIENT
2 VLANs on the WLC (with DHCP on the router):
1. management (VLAN 200 for management and access points - works fine)
2. clients (VLAN 300, all setting are same, except Enable Dynamic AP Management setting, which is off and IP subnet, DHCP on router too).
Clients are able to connect, but they can't get address or ping the gateway of the clients VLAN (if i put this VLAN in the WLAN
Interface/Interface Group(G) setting), but everything is fine, if i set management VLAN to Interface/Interface Group(G) setting of the WLAN.
do i need to add any additional setting on the switches or on the router to allow this clients VLAN?...
P.S. i am able to ping both vlans, or get DHCP address from the switch and router...

yes, just for test, i set up IP from clients VLAN on the L2 switch, and from that switch i am able to ping the controller interface (clients interface).
Just to be clear, do I need to have both VLANS (ap-management and clients VLANs) on all the switches and router on my setup?
As I understand i need to have ap-management vlan only on L2 and L3 switches. Any other VLANs go throught the tunnel between AP and WLC?

VLAN for Wireless network

Dear Team,
If wireless is setup in a corporate network and there is no requirement to provide guest access to outside users, is it still recommended to segregate the Wireless network? What are the advantages for segregating wireless network considering that wireless users will have complete access to corporate network. Kindly share your views if the total number of users in office is less than 50.
Reason is because, we do not have a Layer 3 switch, hence if VLAN is required for small number of users, we will have to enable it on the WAN router.
Would appreciate if you can share any documentation related to best practices. Thank you.
Regards,
Manoj

Hi Manoj,
I agree with Scott,
If you have same subnet for wired & wireless, then devices like Laptops will get same network IP for wired & wireless, client devices may not like that & sometimes may not work.
It is always good idea to have two seperate network for wired & wireless. From scalability point of view having a L3 switch in your network is always beneficial
HTH
Rasika
**** Pls rate all useful responses ****

ISE change of VLAN for wireless endpoints

Hi,
I have configured posture policy on ISE for posture compliant and non compliant end points such that, posture compliant end points will fall in clean VLAN and non compliant will fall in other.
Now, my issue is, even if an end point is posture compliant it is not getting placed in clean VLAN. For getting ip address from clean VLAN, it requires ipconfig /release and ipconfig /renew to be manually done.
how to resolve the issue..
regards,
aditya

Aditya,
At the end of a posture process(NAC agent informs ISE about compliant status) the endpoint already grabbed an IP address on the VLAN is placed as per WLAN settings.
If at this point you push down an overriding VLAN attribute in access-accept(compliant or not) the WLC will successfully switch the client to the new VLAN, but there is no way to force the client to go through DHCP release/ renew.
The only way to trigger something like this after the endpoint grabbed an IP address in old VLAN is to redirect the endpoint back to one of ISE's portals ( CWA / DRW ) and then trigger a VLAN DHCP release renew through java applet. This is the solution salodoh is referring to.
That is the reason why we always recommend dynamic VLAN assignment only as a result of a layer 2 authentication( when client didn't grab an IP yet) .
Regards,
Tony

871W can use 1 vlan for wireless and wire client?

Any example, Thanks.

Here is the URL for the configuration for the 871W and vlan configuration which will help you :
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080608364.shtml#maintask1
http://www.cisco.com/en/US/docs/routers/access/1800/wireless/configuration/guide/s37vlan.html#wp1034625

Dynamic VLAN for wireless

Hi Team,
I have a doubt .....
In our office we have 4 access point .... and as wifi users increases we are planning to create 4 VLAN and each VLAN
have one AP .. but the problem is When wifi users roam from one AP to another AP i,e from one vlan to another vlan they get disconnected.
My question is .... if i deploy dynamic VLAN, will the client be able to get connected to the internet when roaming from one VLAN to another VLAN
without any hiccups .... as this can be real issue when they are on call or transferring files
Below is our current network topology:
Router: LAN: 192.168.1.1 255.255.255.0
DHCP Scope on Router:
VLAN1 - 192.168.1.3 - 250
VLAN10 - 192.168.10.3 - 250
VLAN20 - 192.168.20.3 - 250
VLAN30 - 192.168.30.3 - 250
VLAN40 - 192.168.40.3 - 250
Switch SG300: L3 Mode
VLAN1 - ip 192.168.1.254 (Default VLAN)
VLAN10 - ip 192.168.10.254
VLAN20 - 192.168.20.254
VLAN30 - 192.168.30.254
VLAN40 - 192.168.40.254
AP1 = VLAN10, AP2 = VLAN20, AP3 = VLAN30, AP4 = VLAN40
All local routing between the VLANs are taken care by the Switch
and the router is routing the traffic for all VLANs when client wants to go to internet...
Pliz help......

Hi,
can you please mention are using any controller for these ap's.
If so they should not disconnect because all the traffic is handled by controller.
let say you have client 1 on AP1 as below,
client1- AP1---- AP2
when it roam from AP1 to AP2 it should not disconnect. Due to mobility functionality client should not disconnect nor loss the traffic. Only controller get updated with AP binding table

Auto Assigning A Place

Hello,
I've been playing around with my new iphone 3gs and iphoto. When importing photos etc from different events is it possible for them to have their place auto assigned? For example,
If I took pictures of my house yesterday and today, those will be imported from my iphone as two different events, but would it be possible to add a new location with a radius, so that any photos taken within that radius on the map are assigned 'Home' regardless of when they were taken.
Many thanks for any help.
- Tim

Thanks, I didn't know about that window. I have added a pin and radius for 'Home' now and re-imported my pictures from iphone but on the places map view, it still has not group them into the Home pin, they are still separate and named 'Unnamed Location'

HT4628 How can I set up a standard account to auto disconnect from the wireless network upon logging out (Using Mavericks)? There used to be a setting for this in previous versions of OSX but I can't find it in the new version.

How can I set up a standard account to auto disconnect from the wireless network upon logging out (Using Mavericks)? There used to be a setting for this in previous versions of OSX but I can't find it in the new version.

How can I set up a standard account to auto disconnect from the wireless network upon logging out (Using Mavericks)? There used to be a setting for this in previous versions of OSX but I can't find it in the new version.

The same SSID used at 3 sites and the same vlan for client IP assignment?

we are deploying 5508 controller and LW APs for wireless IP phone 7925G
Controller is installed at site A and there are APs and wireless phones at site B and C as well.
1. can I use the same SSID for all three sites for wireless phones? or have to use 3 distinct SSIDs?
2. If I can use the same SSID, can I associate one subnet e.g 10.10.131.0/24 for wireless IP phones at 3 sites? (our Cisco UCM is fine with this)
3. if I have use 3 distinct SSIDs, do I have to assign three subnets for IP phones at three sites?
thanks for the help!
Eric

yes.. this is done by HREAP mode.. the below link will help you out!!
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807cc3b8.shtml
That is, by default the WLAN will get pushed to all APs.. so if you have a single wlan then this will broadcast the SSID and the remotre site clients will connect to it..
Lemme know if this answered your question!!
Regards
Surendra

Assign VLAN by MAC for one device

Is it possible to assign a single device to a vlan by its mac address?
On a Dell 6248 I could use
vlan association mac 1111.2222.3333 12

Hi,
I don't think there is a command to assign a device to a VLAN by using it's MAC address. But it can be done by setting up a VMPS (Vlan Membership policy server). Which dynamically assigns VLANs to the devices using their MAC or IP address.
Rate if you find this helpful.
Regards,
Chandu

Auto-assigned IP address on an open network

Hi Mac users,
I guess somebody else has already had that problem (or I would really be the unluckiest person in the mac world), but I can't find any solution to it, so PLEASE help me!
I have had my MBP for 6 months, it came with Leopard, and in November I upgraded to Snow Leopard (with someone else's CD that I can't get back do please don't tell me to do a clean Snow Leopard install). I'am not really a Mac pro cause I used to be a Windows user (yeah I know) and I never really got any problems with my Mac so please explain clearly if you have a solution for me!
Here's my problem :
I need to access an open network at my school. You're supposed to connect to this network without entering any weep or pa key, than you get to a page where you login with your school information. Then you get full internet access (web, skype,…)
The thing is that I can't event connect to this network… it says "Airport has an auto-assigned IP address 169.254.143.75 and won't be able to connect to the internet" (my computer is in french so my translation may vary from the english message). This occurs with Automatic DHCP for IPv4, and whether IPv6 is in Automatic or in Disabled setting.
The exact same thing happens whan I connect to the network using the Ethernet cable... I get the auto-assigned IP address and all...
Of course, I tried disabling and enabling Airport, and renewing the DHCP, but I always get this auto-assigned IP address.
I know the problem doesn't come from the hardware because I can connect without any problem to my wireless network at home.
I am using the 10.6.2 version of Mac OS and I already checked that all the available updates are installed.
I had a similar problem before upgrading to Snow Leopard : I could connect once to this open network, but then if I closed the lid of the computer, and then reopen it after a while, it wouldn't connect and I had to restart it entirely...
One of my friends has a Mac running with Leopard, and he has no problem connecting to the network, and neither do the windows user. I don't think it's a problem with the number of connections available on the network because I can NEVER connect to it…
Please help me!!! I'm hoping a Mac genius pops out of the computer and tells me what to do

Bonjour
The weirdest thing is that wired ethernet is not working, not getting an IP address. This may be some kind f incompatibility with the hardware but I doubt it.
Did you check in Airport and Ethernet settings that 802.1X is not enabled and that Ethernet negociation is "Automatiquement".
Also, you can completely wipe network profiles by removing those files from /Library/Preferences/SystemConfiguration/ :
NetworkInterfaces.plist
com.apple.network.identification.plist
com.apple.airport.preferences.plist
Then reboot

VLANs for the WiSM

Hi Everybody,
we followed the cisco layered model in our campus design where we have 6500 switch at the core, 4500 at the distribution and 3750 at the access layer.
The connectivity between the core and the distribution is layer 3, the connectivity between the distribution and access layer is layer 2.we have all the intervlan routing on the distribution switches.we have recently installed two WiSM controllers in our core and planning to deploy light weight access points.
we want to use the exiting VLANS that we created for the wired users on the distribution switch for Wireless LAN users . I wanted to know if this is possible because as the dynamic interfaces for the Wireless VLANS would be created on the WiSM that is on the core switch and as the dynamic interface are like SVIs for the Wireless VLANS.
Secondly i wanted to know what does it mean to assign a VLAN to the WiSM
Regards,
Ahmed Zubedi

I would recommend keeping the wired vlan separate from the wireless vlan.
You need to assign a vlan for the service port of the controllers. This is local to the 6500 and is not routeable. This is how the controllers talk to the 6500. I normally do like a 192.168.1.x

Auto assign vlan for Wireless AP 1142

Similar Messages

Maybe you are looking for