Multiple Vlans Per SSID

Hi
We are just putting in a new Controller - 5500 type
We are using a WCS .
Someone has raised the issue of whether we can have multiple vlans
per SSID - as otherwise we may have very large broadcast domains
due to the overall design being to have Maybe 3 SSIDs
Guest
Staff
Engineering
I think in SWAN we could get away with dynamic vlans.
We would like to have multiple vlans in each SSID to avoid the above.
Can we do this in the new setup.
Kind Regards
Steve

Hi Steve,
yes it works just the same.
Enable AAA override on the controller and have interfaces configured for each vlan. Then the ACS can simply push the vlan depending on the user authentication. Users are then split in separate vlans.
Another way of doing is to group APs. You can have a group of APs serving SSID Guest in vlan 1, Employee in vlan 2 and another group of APs serving the same SSIDs but in vlan 3 and 4. It's "per-user" vlan load balancing or "geographic" vlan load balancing.
However, broadcast domains should not be a major concern in wireless as broadcasts are blocked by default. The WLC will proxy for ARP and DHCP.
Regards,
Nicolas

Similar Messages

Multiple VLANs per SSID with local switch

Is it possible to use an 'AP Group' or 'Interface group' to assign multiple VLANs to a WLAN when remote, h-reap APs are in local switch mode?
If not, is there a way to overcome 500 maximum host per VLAN when APs are local switching?
Thanks!

dont think its possible...
I donno if the following config will even work but u can have the hreap APs connected at the remote site to map to different vlans...
Example:
AP1 -- ssid 1 --- vlan 10
AP2 -- said 1 --- vlan 11 and so forth..
Sounds crazy but i ll have to ponder on this a bit more.. Need a pen and paper to draw a quick topology :)...
Sent from Cisco Technical Support iPhone App

Flex Connect Across Multiple VLANS same SSID

I just need to find that if we have flex connect setup for differnet vlans using single controller, will roaming works when client connects to AP in a differnet VLAN but using same SSID.
Example below:
1) Client connects to AP on specific SSID mapped to VLAN 100, get an IP address ..all good at this point
2) Client walks and connects to a differnet AP on same SSID but mapped to VLAN 200...at this point I observe client doesnt get a new IP address in fact it retain IP from step-1 and there is no connectivity
3) Client walks back to first AP and connectivity is restored
Why in step-2 client doesnt gets a new IP from VLAN 200 even when it shows connected to AP.

Just to add to Rasika.... L3 isn't supported....I just ran into this a few days ago.... clients should request another dhcp when roaming to another FlexConnect AP that is mapped to a different VLAN. The issue is, that some clients don't try to renew their dhcp address and gets stuck with the default 169.x.x.x. I see this with Apple devices in general and what we are going to do is get rid of the multiple vlan setup (vlan per floor) and create a bigger vlan that the SSID will be mapped to.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Need help configuring multiple VLANs and SSIDs

Hi,
We bought a Cisco SGE2000P 24Port switch and 10 WAP4410N access points. Our intent is to provide a secure network to our LAN, and a guest network to the Internet.
We are thinking 3 VLANs would be best for this: VLAN 100 connected to the LAN, VLAN 1000 for the Internet Router and Filter, and VLAN 1100 for the Guest Wireless access.
We have the switch configured for all three of these, and 1 initial access point configured for the VLANS, too.
We have not yet moved the current Internet connection to VLAN 1000 because we aren't sure how to setup routing between VLANS.
Here are some specifics on how the traffic needs to route:
1. We have the DHCP server, which is the PDC, handling both scopes for the LAN and Guest VLAN.
2. The web filter in VLAN 1100 needs to authenticate with the DHCP server as there are different filter rules based on authenticated user. Any users coming from VLAN 1100 will have a default filter rule without requiring any authentication.
3. Certain traffic coming in from the Internet needs to be able to get to VLAN 100. The router has a built-in firewall that handles NAT and port forwarding, so as long as traffic can be forwarded to VLAN 100 we should be good.
4. Traffic on VLAN 1100 (guest Wireless network) should only be allowed to go to Internet (VLAN 1000).
Right now I have the VLANs configured and the ports assigned to the Access Points are set for TAGGED and on VLAN 100 and VLAN 1100.
The SGE2000P has the following IP addresses assigned to the VLANS:
10.7.3.252 - VLAN 100
10.7.40.254 - VLAN 1000
192.168.254.254 - VLAN 1100
Has anyone been able to setup a similar configuration? We have scoured the Internet for documentation but it seems to be very difficult to find!
Thank you!
Gary Smith

Based on your description of a 'Hybrid Port' this sounds like Cisco's 'Multi-VLAN Port' that was a feature of the 2900XL/3500XL series switches. This feature has however long since gone......
With a Cisco switch an access port supporting an Access VLAN & a Voice VLAN is effectively a Trunk with only one Tagged VLAN and the Native VLAN:
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 100
This results in the same configuration as:
interface FastEthernet0/1
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport trunk allowed vlan 100
With the exception of CDP packets being sent advertising the Voice VLAN.
With regards to other IP Phone vendors and DHCP Vendor Options - the answer is it depends....
Nortel use Vendor Option 144 to inform the IP Phone of the Voice VLAN and Option 128 for the Server (PBX) to use. Ericsson uses Vendor Option 43 that can be configured to tell the IP Phone the VLAN and the Web server to read the config file from.
I don't think you will get this working automatically with your 3Com switches, you can however manually configure the VLAN on the Cisco IP Phones.
HTH
Andy

Binding multiple VLANs to single SSID on WLC

I have a building with over 4000 users and would like to bind multiple VLANs for user access to a single SSID in WLC. Can this be done? I would rather not have 4000 wireless users on a single VLAN.

the question is tough. You can not use the SSID in on AP for multiple vlans. Once you assign the AP to the vlan then you will have to make all traffic in the vlan. With that being said. you could assign the AP's to specific vlans, but if you roam from one vlan to another you will have problems at L3. But you can use WDS to make that happen.
Here are a couple of links tha might help.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00804d4421.shtml
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_guide_chapter09186a0080184ace.html

Multiple SSID With Multiple VLANs configuration on Cisco Aironet APs: Assotiated clients cannot obtain IP addresses

Hi Surendra,
I was just given this task to see how i can configure a second ssid for guest access in our environment.
this is our network setup prior to this request: Internet----Firewall (not ASA)---ce520---C1131AG and CME router is also connecting to the ce520 switch. we only have two vlans: one for voice and two for data.
Presently, there is no vlan configured on the AP because it on broadcasting ont ssid and wireless users gets IP from a windows DHCP server on the LAN. the configuration on the ce520 switch port for the AP and other switches say access vlan is the DATA vlan which automatically becomes the native vlan for all trunk port connecting the AP and other Stiches to the network.
Now with this new requirement, i have made my research and i have configured the AP to broadcast both the production and the guest Vlans. The two vlans are 20-DATA and 60-Guest. I made the DATA vlan on the AP the native vlan since the poe switch is using the DATA vlan as native on the trunk ports. I configured the firewall to serve as DHCP server for the guest ssid and i have added the ip helper-address on the guest vlan interface on all switches while the windows server remains the dhcp server for the production DATA Vlan. I have confirmed that the AP, switches can ping the default gateway of the guest dhcp server which is another interface on the firewall. I can now see and connect to all broadcasted ssids but the problem is I am not getting IP addresses from both the production dhcp server and guest dhcp server when i connected to the ssid one at a time.
My AP config is attached below.
Please tell me what am I doing wrong.
Do i need to redesign the whole network to have a native vlan other nthan the data vlan?
Does the access point need to be aware of the voice vlan?
Do the native Vlan on the AP need to be in Bridge-group 1 or can i leave it in bridge-group 20?
I will greatly appreciate your urgent response.
Thanks in advanced.

Hi,
As far as i know we dont set the ip helper address on the radio interface. It should be on the L3 interface of corresposding VLANs i.e.
int vlan 20
ip helper-address 192.168.33.xxx
int vlan 60
ip helper-address 130.20.1.xxx
I'm assuming that your using SVI's (int Vlan 20 and int Vlan 60) rahter than physical interfaces. Also hope you have configured switch port as trunk where this AP is connected.
Modify the AP config as below since you are using data vlan as the native vlan
interface Dot11Radio0.20
encapsulation dot1Q 20 native
interface FastEthernet0.20
encapsulation dot1Q 20 native
Ideally your AP fastethernet configuration should looks like below and not sure how you missed this as this comes by default when you have multiple vlans for multiple ssids.
interface FastEthernet0.20
encapsulation dot1Q 20 native
no ip route-cache
bridge-group 20
no bridge-group 20 source-learning
bridge-group 20 spanning-disabled
interface FastEthernet0.60
encapsulation dot1Q 60
no ip route-cache
bridge-group 60
no bridge-group 60 source-learning
bridge-group 60 spanning-disabled
Hope this helps.
Regards
Najaf

Multiple VLAN's, one SSID

I'm getting to the point where my campus wireless network is growing past the subnet size that I'm comfortable dealing with. I have a WiSM and WCS and am running the newest IOS on each. Is there any way to use multiple VLAN's on one campus-wide SSID?
Or, can I put the same SSID on the two controllers and map it to two separate VLAN's without causing roaming issues?
Thanks,
Eric

Hi Eric,
Yes we can do this and this feature is called AP Grouping on WLC... Here is the configuration example to do the same..
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008073c723.shtml
Regards
Surendra

Bridge with clients & multiple VLANs on 1242 AP

Hi,
I am trying to set up a test as per the attached diagram. I am looking to use 2x 1242 access points to bridge to a remote part of the network.
I currently have 2 VLANs on the network, all network devices are on VLAN 1 for management and client access is on VLAN 2.
What I am trying to achieve is to bridge between the two access points and also have clients connect to VLAN 2 on each access point.
Firstly, are the 1242's capable of this or would I need to look at a 1300 Bridge?
I have attached a copy of the base config I have on both AP's, the only difference between them is the root or non-root role.
My bridge link currently works and I can ping across it on VLAN 1 but I cannot get a client to connect to the SSID on VLAN2. Although the SSID is set to guest mode I cannot see it being broadcast and if I manually try and connect nothing happens.
Is there anything basic I am missing here or can anyone offer advice on bridging multiple VLANs with 1242 AP's?
Thanks,
Paul

Ooops....forgot to add the attachments first time.
Thanks,
Paul.

Encrypting Aironet 1410 bridge link using multiple VLANs

I've looked at the documentation available for Aironet 1400 series, and still would like to see a single document showing an example of
the best encryption/authentication available for bridge links using multiple VLANs.
As I understand it, 1400 series can support WPA-PSK using AES, which would work for me. I just can't picture how to integrate chapters 9 and 10 for the 'WEP and WEP Features' + 'Configuring Authentication Types' instructions.
I'm looking either for an example config, or a step-by-step that did all steps consecutively.
Thanks

What doc are you refering to? If you want to encrypt the link from root bridge to non-root bridge, then WPA/TKIP-PSK is what you should use. Here is a link to how to setup your link ssid to WPA: http://www.cisco.com/en/US/docs/wireless/bridge/1400/12.2_15_JA/configuration/guide/p15auth.html#wp1044935
Don't worry about the example they show on the WEP, just use the configuration from the above link for your encryption.
Configuring a VLAN
Configuring your bridge to support VLANs is a five-step process:
1. Create subinterfaces on the radio and Ethernet interfaces.
2. Enable 802.1q encapsulation on the subinterfaces and assign one subinterface as the native VLAN.
3. Assign a bridge group to each VLAN.
4. (Optional) Enable WEP on the native VLAN. <-- Use WPA-PSK
5. Assign the bridge's SSID to the native VLAN.
http://www.cisco.com/en/US/docs/wireless/bridge/1400/12.2_15_JA/configuration/guide/p15vlan.html
Here is an example of vlan 1 (native) will be your management and your wireless link. vlan 10 & 20 will pass through the link.
BR# configure terminal
BR(config)# interface dot11radio0.1
BR(config-subif)# encapsulation dot1q 1 native
BR(config-subif)# bridge group 1
BR(config-subif)# exit
BR(config)# interface fastEthernet0.1
BR(config-subif)# encapsulation dot1q 1 native
BR(config-subif)# bridge group 1
BR(config)# interface fastEthernet0.10
BR(config-subif)# encapsulation dot1q 10
BR(config-subif)# bridge group 10
BR(config)# interface fastEthernet0.20
BR(config-subif)# encapsulation dot1q 20
BR(config-subif)# bridge group 20
BR(config-subif)# exit
BR(config)# interface dot11radio0
BR(config-if)# ssid batman
BR(config-ssid)# vlan 1
BR(config-ssid)# infrastructure-ssid
BR(config-ssid)# end

DLSW ethernet redundancy for multiple vlans

Can dlsw ethernet redundancy support mutliple vlans with the following configuration?
host dlsw router1 host dlsw router2
| |
local dlsw router 1 local dlsw router2
| |
ethernet switch1-------ethernet switch2
Ethernet switch1 and 2 are supporting multiple vlans and connected to local dlsw router1 and 2 through 802.1Q. SNA support is required for the vlans of ethernet switch1 and 2 .
We found that configuration of dlsw ethernet redundancy is not allowed on the 802.1Q sub-interface of the local dlsw router1 and 2. In this case, how can dlsw ethernet redundancy can be supported for SNA server attached to multiple vlans? Can you provide us some reference / sample for dlsw ethernet redundancy to support SNA servers attached to different vlans in a switch environment.
Thanks.

I think that I understand the problem. I am thinking the following:
dlsw local-peer peer-id 2.2.2.2 promiscuous
dlsw transparent switch-support
interface Ethernet0
mac-address 0000.3333.3333
dlsw transparent redundancy-enable 9999.9999.9999 master-priority 10
dlsw transparent map local-mac 0000.6666.0000 remote-mac 0200.eca2.0000 neighbor 0000.5555.5555
interface Ethernet1
mac-address 0000.4444.4444
dlsw transparent redundancy-enable 9999.9999.0001 master-priority 10
dlsw transparent map local-mac 0000.6666.0001 remote-mac 0200.eca2.0000 neighbor 0000.7777.7777
Of course, you need an ethernet interface per VLAN. If you need DLSw ER over dot1q interface, please contact the local Cisco Sales Rep or partner. You are not the first one to ask for it. Hope that there is a strong business case to initiate the new feature.

Is it possible to do multiple prints per page on 4x6, on B110?

The subject pretty much sums it up... I can do multiple prints per page on other sizes of paper (A4 etc), but there is no option to do so on 4x6.
This is pretty annoying, because the Epson printer I was replacing can do this. The follow-up question, therefore, is if I can't do it through HP's software, if I re-download Epson Easy Photoprint will I be able to use it for the HP printer?
Thanks.

Hi Don,
Im afraid on the autonmous platform you can not map multiple WLANS to a single vlan.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Wireless Controller locking down User per SSID

I am using Wireless Controller 4112. We use WPA enterprise mode for authentication and encryption via Microsoft IAS server and MS AD domain.
My question is how to lock down a user to a specific SSID? I would guess that this is via some vendor specific radius attributes, am I right? And if so, what would be the name (and ID) for the attributes?
Thanks in advance.

Making progress in setting up the wireless controller with multiple VLAN and WLAN/SSID. I create a virtaul interface at the controller and assign a VLAN number to it. The controller mgmt port is also set to a trunk port. Create a new SSID WLAN and have it mapped to the new virtual interface. Things work good.
The new problem I am trying to solve is how to prevent wired users to access the controller admin web interface via the virtual interface IP. I try create ACL and map it to the virtual interface. It doesn't seem working.

Scenario for single WLAN to multiple VLANs

Hi there,
I read from this forum some discussion about the WLC VLAN Select feature.
http://www.cisco.com/image/gif/paws/113465/vlan-select-dg-00.pdf
I see that you can use this feature to have multiple VLANS (interfaces) to map to the same WLAN (SSID).
What I try to learn is under what scenarios would people need to have mutliple vlan mapped to single SSID?
In my environment, I have 50+ AP int he campus on 20+ Cisco 4500 switches. I have single WLAN and it is mapped to one subnet. All wireless users would be on that subnets, whereas wired users are on 20+ subnets of their own.
Can someone help me to see under what scenarior (or requirement) that I would want to have multiple vlans mapped to single SSID?
Thanks.

having a large number of users in single subnet is not the best in all designs, since you will have a large single broadcast domain which is a true disaster with dense networks. If you the company policy states that we need only one single ssid
for the whole employees within the company, it doesn't make sense to have them all on the same subnet.
A lot of options are available to overcome such issues :
for example, we might have AP groups feature , dynamic vlan assignment given that we have radius server in place, and vlan pooling.
It might not be feasible to have RADIUS server all the time, and AP groups might be kind of administrtive overhead as well as it might induce a lot of issues when aps fail over from controller to controller --> Vlan select is a good soultion considering the previously mentioned reasons.
Please Make sure to rate correct answers

Multiple VLAN config help

I need to configure our Cisco Aironet 1200's for multiple VLANs. VLAN101 is for public use & VLAN2 is for employees only. Existing config is attached.
I need:
1. To disable the broadcast of VLAN2's SSID so that only VLAN101 shows up in the SSID list for visitors. Right now both are showing up.
2. To ensure the WEP key is setup correctly for VLAN2
Thanks in advance for your help!

So are you saying both SSID's are currently broadcasting?
I would delete and re-create your client configurations. I don't think it's on the AP side.

QoS Override Per-SSID Bandwith question

Hi all,
on a WLAN there is the possibility to override the QoS Bandwidth settings.
I try to get some more information about these settings, I want to understand this. As well a customer wants to limit user data.
My question is: This override Per-SSID, are these settings on a AP basis or on the global controller basis?
The next question resulting out this will then be what if the AP is set to flex-connect with local VLAN traffic, what then?
Is there a good documentation on this?
Thanks.

This section describes BDRL of the 7.3 release. In releases 7.2 and earlier, there is only the ability to limit the downstream throughput across an SSID and per user on the Global interface. With this new feature in the 7.3 release, rate limits can be defined on both upstream and downstream traffic, as well as on a per WLAN basis. These rate limits are individually configured. The rate limits can be configured on WLAN directly instead of QoS profiles, which will override profile values.
This new feature adds the ability to define throughput limits for users on their wireless networks with a higher granularity. This ability allows setting a priority service to a particular set of clients. A potential use case for this is in hotspot situations (coffee shops, airports, etc) where a company can offer a free low-throughput service to everyone, and charge users for a high-throughput service.
Note: The enforcement of the rate limits are done on both the controller and AP.
Rate limiting is supported for APs in Local and FlexConnect mode (both Central and Local switching).
When the controller is connected and central switching is used the controller will handle the downstream enforcement of per-client rate limit only.
The AP will always handle the enforcement of the upstream traffic and per-SSID rate limit for downstream traffic.
For the locally switched environment, both upstream and downstream rate limits will be enforced on the AP. The enforcement on the AP will take place in the dot11 driver. This is where the current classification exists.
In both directions, per-client rate limit is applied/checked first and per-SSID rate limit is applied/checked second.
The WLAN rate limiting will always supercede the Global QoS setting for WLAN and user.
Rate limiting only works for TCP and UDP traffic. Other types of traffic (IPSec, GRE, ICMP, CAPWAP, etc) cannot be limited.
Only policing is implemented in the 7.3 releases.
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113682-bdr-limit-guide-00.html

Multiple Vlans Per SSID

Similar Messages

Maybe you are looking for