This deployment guide describes the implementation of wireless virtual LANs (VLANs) over the 802.11 interfaces for Cisco Aironet® 1200, 1100, 350, and 340 Series Access Points and the Cisco Aironet 350 Series Wireless Bridge. Within this document, the concept of wired and wireless VLANs is introduced, detailed feature descriptions of wireless VLANs are presented, and guidelines for deploying wireless VLANs are reviewed.
According to the IEEE, VLANs define broadcast domains in a Layer 2 network. Traditional networks use routers to define broadcast domain boundaries. Layer 2 switches create broadcast domains based on the configuration of the switch. Switches are multi-port bridges that allow the creation of multiple broadcast domains. Each broadcast domain is a distinct virtual bridge within a switch.
VLANs have the same attributes as physical LANs with the additional capability to group end stations physically to the same LAN segment regardless of the end stations' geographical location. Figure 1 shows an example of three wired VLANs in logically defined networks.
Figure 1 Example Deployment of Wired VLANs
Single or multiple virtual bridges can be defined within a switch. Each virtual bridge created in the switch defines a new broadcast domain (VLAN). Switch interfaces assigned to VLANs manually are referred to as interface-based or static membership-based VLANs. This type of VLAN is often associated with IP sub-networks. For example, when all of the end stations in a particular IP subnet belong to the same VLAN, traffic cannot pass directly to another VLAN (between broadcast domains) within the switch or between two switches. Traffic between VLANs must be routed.
To interconnect two different VLANs, routers or Layer 3 switches are used. These routers or Layer 3 switches execute inter-VLAN routing or routing of traffic between VLANs. Broadcast traffic is then terminated and isolated by these Layer 3 devices (for example, a router or Layer 3 switch will not route broadcast traffic from one VLAN to another).
The two most common VLAN trunking protocols used on Cisco switches and routers are Inter-Switch Link (ISL) and IEEE 802.1Q. ISL, a proprietary Cisco protocol, and 802.1Q are encapsulation standards used to interconnect multiple switches and routers via trunking. For more information on these VLAN trunking protocols, please refer to the following URL: http://www.cisco.com/pcgi-bin/Support/PSP/psp_view.pl?p=Internetworking:Trunking
The concept of Layer 2 wired VLANs is extended to the wireless LAN (WLAN) with wireless VLANs. As with wired LANS, wireless VLANs define broadcast domains and segregate broadcast and multicast traffic between VLANs. When VLANs are not used, an IT administrator must install additional wireless LAN infrastructure to segment traffic between user groups or device groups. For example, to segment traffic between employee and guest VLANs, an IT administrator must install two access points at each location throughout an enterprise WLAN network (as shown in Figure 2). However, with the use of wireless VLANs, one access point at each location can be used to provide access to both groups.
Figure 2 User Segmentation Without Wireless VLANs
With VxWorks Firmware Release 12.00T or later and Cisco IOS® Software Release 12.2.4-JA or later, an 802.1Q trunk can be terminated on an access point (Cisco Aironet 1200, 1100, 350, or 340 Series) or on a bridge (Cisco Aironet 350 Series), allowing access up to 16 wired VLANs. A unique Service Set Identifier (SSID) defines a wireless VLAN on the access point and the bridge. Each SSID is mapped to a VLAN-ID on the wired side with a default SSID to VLAN-ID mapping. Additionally, with wireless LANs, a per-VLAN network security policy is defined on the access point and on the bridge by the IT administrator. Sections 3 and 4 discuss this in detail.
Wireless VLAN deployment is different for indoor and outdoor environments. For indoor deployments, the access point is generally configured to map several wired VLANs to the wireless LAN. For outdoor environments, 802.1Q trunks are