 access-security "levels" to access the WLAN. For example, it is not recommended to allow handheld computers that support only 40/128-bit static-WEP to co-exist with other WLAN client devices using 802.1X with dynamic WEP in the same VLAN. In this scenario, devices are grouped and isolated with different "levels" of access security into separate VLANs.
A wireless VLAN deployment example is outlined below. The IT administrator of company XYZ determines the need for wireless LANs in his network. Using the guidelines described in Section 4.1, his findings are as follows:
3. Full-time employees need full access to the wired network resources. The IT department has implemented application-level privileges for each user (using Microsoft Windows NT or Active Directory (AD) mechanisms).
4. Part-time employees are not allowed access to certain wired resources (such as human resource servers, data storage servers, and so on). Furthermore, the IT department has implemented application-level privileges for part-time employees (using Microsoft Windows NT or AD mechanisms).
6. Maintenance personal (electrical, facilities, and others) use specialized handheld computers that support static 40- or 128-bit encryption to access trouble ticket information via an application server VLAN.
1. Create "Full-Time" and "Part-Time" VLANsImplement 802.1X with dynamic WEP along with TKIP capability for WLAN access. Tie user login on the RADIUS server with Microsoft back-end user database to enable "single sign-on" for WLAN users.
Implement RADIUS-based SSID access control for both "Full-Time" and "Part-Time" employees to access WLAN. This is recommended to prevent part-time employees from VLAN "hopping" (for example, trying to access the WLAN using "Full-Time" VLAN).
Note: In this deployment scenario, VLANs are localized per building with user group mapping to wired VLAN-IDs different for each building. In order to enable users to access the WLAN from anywhere on campus, SSID access control is recommended rather than fixed VLAN-ID assignments.
2. Create a "Guest" VLAN: Implement open/no WEP access with a broadcast SSID by using the primary SSID for "Guest" VLAN. Enforce policies on the wired network side to force all "Guest" VLAN access to an Internet gateway and deny access into the corporate network.
3. Create a "Maintenance" VLANImplement open/with WEP plus MAC authentication for this VLAN. Enforce policies on the wired infrastructure to only allow access to the maintenance server on the application server's VLAN.
Figure 7 Wireless VLAN Deployment Example
Table 3 Configuration for VLANs in Figure 7
|SSID||VLAN-ID||Security Policy||RADIUS-Based VLAN Access Control|
1. Limit broadcast and multicast traffic to the access point and bridge by enabling VLAN filtering and Internet Group Management Protocol (IGMP) snooping on the switch ports. On the 802.1Q trunks to the access point and bridge, filter to allow only active VLANs in the ESS. Enabling IGMP snooping prevents the switch from flooding all switch ports with Layer 3 multicast traffic.
3. The access point does not support Virtual Terminal Protocol (VTP) or Generic Attribute Registration Protocol VLAN Registration Protocol (GVRP) protocols for dynamic management of VLANs because the access point acts as a "stub" node. The IT administrator must use the wired infrastructure to maintain and manage the wired VLANs.
- The IT administrator could implement ACLs on the wired infrastructure to force all "guest" VLAN traffic to the Internet gateway.
- The IT administrator should restrict user access to the native/default VLAN of the access points and bridges with the use of Layer 3 ACLs and policies on the wired infrastructure.
- Example: Traffic to access points and bridges via the native/default VLAN is only allowed to and from the management VLAN where all the management servers including the RADIUS server reside.
Figure 8 Main Setup Page
Figure 9 Main VLAN Set Up Page
Figure 10 Native VLAN Configuration
Figure 11 Enabling 802.1Q Trunking
Figure 12 802.1Q Encapsulation Mode
Figure 13 "Guest" VLAN Configu