VLAN assignment depending on AP for one SSID

Hi,
I read the AP Group VLANs with WLC configuration examples but did not find exactly what I look for. I'm on a WLC 5500.
I try to create AP groups which broadcast a set of SSID, but inside AP groups, depending on the AP on which the connection is made, i want to assign a specific VLAN for the clients.
If connection is made on SSID1 and AP1 -> one VLAN, for example VLAN_SSID1_AP1
same for SSID1 and AP2 -> another VLAN, for example VLAN_SSID1_AP2
I want to assign some VLANs to one of my networks to get local IPs depending on the AP.
The VLAN are all defined as dynamic interfaces, currently the SSID matches one VLAN, but i did not find how to do this assignment. I cannot define a VLAN for a network(SSID) and an AP.
Thanks for your ideas,
Christophe

You need to create two AP Groups. Both will have the SSID, but AP Group #1 will have SSID mapped to vlan 1 and AP Group #2 will have SSID mapped to vlan 2. Then you add the appropriate ap's to which group you want.

Similar Messages

HREAP & Local mode configuration for one SSID

I'm looking to provide one SSID Corporate access to multiple sites using HREAP. My question is it possible to configure one SSID and switch the traffic locally?
I have a controller in the main site that provides one SSID for Corporate access (AP's in Local mode) and would like to have the same SSID used at the remote sites, only difference is the break out locally.
Do I need to configure the HREAP interface on the controller if it is switching locally at the remote site? If so what interface should it be? I thought it would be locally anyway?

yes, you can do this.
In the WLAN, select HREAP Local switching. This does not mean that the WLAN is always locally switched, just that it can be.
Put the AP that need to be HREAP/FlexConnect in that mode, reboot, then map the WLAN to the approrpriate VLAN for that site.
For the AP that you want to do central switching, just leave them as they are.
Steve

Assign Multiple Sales Org for One Plant in STO process

Hi Experts,
Aware that I can assign multiple sales org to 1 plant (relationship: many to many).
I am trying to create STOs to supplying plant and assigning them to different sales organization but encountered problem.
Example:
Supplying Plant 1000 - Sales Org 1000A (food) and 1000B (apparel)
Receiving Plant 1100
Plant 1100 wants to issue 2 STOs to Plant 1000 - 1 for each Sales Org (for instance STO1 to food division, and STO2 for apparel division).
However, when I tried creating STO in the system, noticed that in the shipping tab (item details) the sales org, DC has been assigned to 1 particular assignment and data is locked.
Tried to get into SPRO to configure and define the shipping data for plants but noticed that it's 1 to 1 relationship (SPRO - IMG - MM - PO - Set up Stock Transport Order - Define Shipping Data).
How can this be done?

You can set different sales areas (~sales organisation) for one plant in SAP - based on issuing SLoc provided STO between storage locations is activated.
SPRO > Materials Management > Purchasing > Purchase Order > Set up Stock Transport Order > Set Up Stock Transfer Between Storage Locations > Define Shipping Data for Stock Transfers Between Storage Locations
Edited by: Csaba Szommer on Jul 2, 2011 6:14 PM

Remove PR Mandatory for PO and Assign new PO Layout to one User

Hi Experts,
I want to remove PR mandatory for PO and assign new PO Layout for one User. I am facing following problem.
1. I have already created a function authorisation Z1 with reference to PR and assign the same in SU01, Paramenter EFB - Z1.
Now I have removed ref to purchase requisition tick and assign new PO layout in Z1.
But ref to PR not removed, and new po layout is not coming.
What should I do.
Thanks in advance.
GR

why dont u assign the new PO screen layout to the PO document type thru spro-mmpurchasingpo-define document type---here assign ur new field selection with the PO document type coz whatever the screen layout of PO comes while processing me21n,it comes due to the field selection present here as per my knowledge.
regards,
indranil

FlexConnect VLAN assignment changes by itself

About a year ago I changed the VLAN assignment of a WLAN for LWAPs in a particular AP Group. The LWAPs in this group are in 5 different locations. All LWAPs are joined to the same controller Ocassionally I'll get a call saying this WLAN isn't working and when I investigate the issue, I notice that the VLAN assignment has changed. I change the VLAN assignment and the WLAN works again. This seems to happen about every 3 months or so. Whats odd is that it doesn't happen to all of the LWAPs in the AP Group. It seems to only affect the LWAPs at one site or the other at a time. Any clues on what could be causing this behavior?
1142LAPs
software version 7.3.101.0
5508WLC
software version 7.3.101.0
Cisco Prime Infrastructure
software version 1.2 (1.2.0.103)

We can create a command -line to set the WLAN to VLAN mapping and create .Or we can create a script that also uses CLI and simply paste the commands to all AP's.We can check the AP connectivity statistics by looking at the monitor AP.
For FlexConnect access points, the interface mapping at the controller for WLANs configured for FlexConnect local switching is inherited at the access point as the default VLAN tagging. This can be easily changed per SSID and per FlexConnect access point. Non-FlexConnect access points tunnel all traffic back to the controller, and VLAN tagging is dictated by each interface mapping of the WLAN
By default, a VLAN is not enabled on the FlexConnect access point. When FlexConnect is enabled, the access point inherits the VLAN ID associated to the WLAN. This configuration is saved in the access point and received after the successful join response.
By default, the native VLAN is 1. One native VLAN must be configured per FlexConnect access point in a VLAN-enabled domain. Otherwise, the access point cannot send and receive packets to and from the controller. When the client is assigned a VLAN from the RADIUS server, that VLAN is associated to the locally switched WLAN.

Design: different AP Groups for different SSIDs?!

Imagine I have different requirements for the AP Groups for different SSIDs
I suppose I can't have different AP Groups for different SSIDs?!
Imagine I have to many Clients to use one single VLAN for one SSID. So I will use AP Groups.
For SSIDâXâ
Let's say I have 5 buildings with 800 Users, so I make a AP Group per Building and tell those APs that they are in that group.
For SSIDâYâ
All though I have this SSID also in all 5 buildings, I only have very view Users, so I could make one single VLAN which makes everything easier.
Am I obligated now to create 5 VLANs for SSIDâYâ too?!
*This is a made up example. In reality I would make different numbers of AP Groups for different SSIDs because I have significantly different number of Clientsâ¦ and traffic characteristics (more or less broadcast).
But it's also about the size of the VLANs, do I make a view large Broadcast Domains (VLANs) or more small ones.
Greetings, Andi

You can have a setup like this if you want:
AP Group 1
SSID X Vlan 10
SSID Y Vlan 21
SSID Z Vlan 31
AP Group 2
SSID X Vlan 10
SSID Y Vlan 22
SSID Z Vlan 31
AP Group 3
SSID X Vlan 10
SSID Y Vlan 23
SSID Z Vlan 32
AP Group 4
SSID X Vlan 10
SSID Y Vlan 24
SSID Z Vlan 32
AP Group 5
SSID X Vlan 10
SSID Y Vlan 25
SSID Z Vlan 33
AP Group 6
SSID X Vlan 10
SSID Y Vlan 26
SSID Z Vlan 33
Here is a link, which you probably already saw.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008073c723.shtml

802.1x RADIUS with EAP-TLS/EAP-TTLS & Dynamic VLAN Assignment

Hello, My team is looking for switches supporting 802.1x authentication on either EAP-TTLS or EAP-TLS protocols with dynamic vlan assignment enabled for these. Looking at the data sheets of the Linksys desktop switches, I found only SLM224G4PS and SLM224G4S models to support EAP-TLS or EAP-TTLS. Am I right? Do they support Dynamic VLAN Assigment for either of those protocols? This is not explicitly mentioned in the data sheets, and I happen to find switches from other manufacturers that announce to support EAP-TLS/EAP-TTLS but no dynamic vlan assignment. Thank you for any help.

SLM switches do support 802.1x RADIUS with EAP-TLS/EAP-TTLS unlike the SRW switches which support MD5. But I don't think that they support Dynamic VLAN.

Is dynamic VLAN assignment supported with web-authentication?

The 7.6.130.0 WLC configuration guides says this:
"Dynamic VLAN assignment is not supported for web authentication from a controller with Access Control Server (ACS)"
How should we interpret this, exactly? Does this mean that dynamic VLAN assignment is supported with web authentication from a controller if some other RADIUS server is used (Eg: FreeRadius, ISE)?

It is not supported with any kind of radius server. The radius attributes ACS uses for pushing those settings (64,65,81) are the same for every other radius implementation. Pushing a QoS profile does work.

Two sids for One instance

Hi All,
I have to create two sids for one database. I am using Oracle 9i on Windows machine as well as linux machine. Is there any possible to assign two sid's for one database.
Give me the suggestions...
Cheers,
Moorthy.GS

I think you need to define your term 'database' here
In Oracle world, database is usually referred to as instance.
a SID is one database instance, that's why, people will tell you that you can't have two SID for one database (instance)
However, if your 'database' means the schema and data, then yes, you can run two instances (with two SID of course) to host the same schema and data.

Input Masks for one field

Hi,
Can I assign different input masks for one field on a presentation?
Thanks

Hi vijay,
1. U have not given proper parameters
while calling the FM.
2. have a look at this (just copy paste)
3.
REPORT ABC.
DATA : BEGIN OF ITAB OCCURS 0,
UNAME LIKE USR01-BNAME,
END OF ITAB.
data : RETURN_TAB LIKE DDSHRETVAL occurs 0 .
data : RETURN_wa LIKE DDSHRETVAL .
PARAMETERS : A(12) TYPE C.
AT SELECTION-SCREEN ON VALUE-REQUEST FOR A.
ITAB-UNAME = 'U01'. APPEND ITAB.
ITAB-UNAME = 'U02'. APPEND ITAB.
ITAB-UNAME = 'U03'. APPEND ITAB.
CALL FUNCTION 'F4IF_INT_TABLE_VALUE_REQUEST'
EXPORTING
DDIC_STRUCTURE = ' '
retfield = 'ITAB-UNAME'
PVALKEY = ' '
DYNPPROG = SY-REPID
DYNPNR = SY-DYNNR
DYNPROFIELD = 'A'
STEPL = 0
WINDOW_TITLE =
VALUE = ' '
VALUE_ORG = 'S'
MULTIPLE_CHOICE = ' '
DISPLAY = ' '
CALLBACK_PROGRAM = ' '
CALLBACK_FORM = ' '
MARK_TAB =
IMPORTING
USER_RESET =
tables
value_tab = ITAB
FIELD_TAB = FTAB
RETURN_TAB = return_tab
DYNPFLD_MAPPING =
EXCEPTIONS
PARAMETER_ERROR = 1
NO_VALUES_FOUND = 2
OTHERS = 3
break-point.
regards,
amit m.

Different apprasial template for one module(SM)

Dear experts,
We are implementing SLCM in our university.
More than one instructor want to make different apprasials for the same
module(by assigning two different instructors to TWO business events
under ONE module(lesson))
"Instructor" is assigned to business event(E) and "Appr. Template" is
assigned to (SM) module.
So how can process this case?
We mean,
Instructor A will use appraisal template T1 for module "CALCULUS101"
Instructor B will use appraisal template T2 for the same
module "CALCULUS101"( by instructing other business event under
module "CALCULUS101")
How can we assign different appraisal templates for one module(SM)?
Best regards,

module/lesson is "CALCULUS101
Transcript of student X (student of instructor A-with appraisal template structure T1
(2 exam and 1 final):
CALC101--- B+
Transcript of student Y(student of instructor B-with appraisal template structure T2
(1 exam and 1 final):
CALC101--- C+

WLC 4402 assign multiple VLANs to one SSID

Is it possible to have one broadcasting SSID but clients seperated by, lets say say 7 different vlans in the WLC? For example- each floor would be seperated by its own vlan and dchp pool, but they all connect to one SSID in the controller. From what I just read it seems that each vlan would be assigned its own SSID?

For anyone needing further info see here:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008073c723.shtml

Cisco av-pairs SSID vs Dynamic Vlan Assignment

Hello,
Once upon a time, there was a Cisco av-pairs attribute to allow a Wireless user to a given SSID through Radius servers.
If I'm not wrong, this feature has not been supported anymore (for several years) on WLC.
Dynamic vlan assignment is an alternative way to control user acces to a given vlan. It simplifies the architecture, because only one SSID is needed and the user traffic is then redirected to the right vlan. But... There is an important issue with it, since only one SSID (and BSSID) is used, broadcast packets from all vlans are transmitted to everybody. It is an issue when some services use broadcast to announce their features (IPv6 autoconf, Bonjour, and so on...).
So the question is if a working alternative to SSID av-pairs exists.
Thanks.

To be honest, I have never heard of this SSID av-pair ever working in wireless:)
You would need at least two ssids and the radius server would need to ability to send a CoA to dissassociate the device so that the device would join the other SSID. The radius server would also have to push out the wireless profile to the client for the SSID they need to associate to. This can be done using Cisco ISE, but not Microsoft radius or even Cisco ACS.
You can still use aaa overuse to place devices on specific vlans and use the WLC to allow bonjour or ACLs to filter what you don't want going out of the vlan. WLC has bonjour capabilities and thus you can specify that on the interface and not on the WLAN. If course their are limitations, but with newer requirements means that there is no one answer. You might be able to meet certain requirements, but other you will have to sort of figure out.
-Scott

VLAN Assignment of SSID using Cisco AV Pair or Dot1x ?

Hi.
I am looking to setup wireless access to 2 of my internal VLANs. I am using Cisco 1130AG, PEAP and RADIUS for the authentication as one network is for employees only and one restricted to guests only.
I was wondering which was the most recommended solution.
1. To have 2 SSIDs, with one in each VLAN with the access restricted using the Cisco AV Pair attribute in RADIUS
or
2. Use one SSID and use Dot1x and the Tunnel attribute to assign the VLAN?
This option I feel is more complicated and I am still unsure how this works in reality as the SSID itself can only be part of one VLAN????
Do I have to configure a Dot11Radio and Fastethernet interface for each intended vlan in this case?
Could someone please explain and suggest their preferred option.
Thanks.

You should have two ssid's one for your internal and one for guest. You should use 802.1x for your internal and your guest should be open with a Login page of some sort. You can still use dynamic vlan assignments so that your internal users who try to access the guest page will be put on the internal vlan. Of course the guest will always be placed on the guest vlan. If you have a WLC, the login page and setup is easier, because in autonomous you will have to use something like ZoneCD for guest if you want a HotSpot type wifi.

ISE/Wireless NAC...One SSID for MAB and Dot1X?

Hi,
I am running ISE 1.2 and WLC 7.5.102.
I would really like to have one SSID that can do a few different things in the following order...
1) A device could connect, hit the MAB rule, and be granted access without any type of authentication (Other than MAB) and be placed in VLAN x.
2) A device would be checked for the appropriate certificate. If this cert exists, the device is granted access.
3) If a device is not allowed in MAB, it will hit the next rule, which is the dot1x rule. The user will then be authenticated against the AD server.
4) Everything else hits default rule and is sent to web-auth portal.
I can't really think of a way to make this work with one SSID because from what I understand, you would need dot1x disabled on the SSID in order for MAB to work.
Any suggestions?
Thanks.

two ssid's. no way around it

VLAN assignment depending on AP for one SSID

Similar Messages

Maybe you are looking for