 most common VLAN trunking protocols used on Cisco switches and routers are Inter-Switch Link (ISL) and IEEE 802.1Q. ISL, a proprietary Cisco protocol, and 802.1Q are encapsulation standards used to interconnect multiple switches and routers via trunking. For more information on these VLAN trunking protocols, please refer to the following URL: http://www.cisco.com/pcgi-bin/Support/PSP/psp_view.pl?p=Internetworking:Trunking
The concept of Layer 2 wired VLANs is extended to the wireless LAN (WLAN) with wireless VLANs. As with wired LANS, wireless VLANs define broadcast domains and segregate broadcast and multicast traffic between VLANs. When VLANs are not used, an IT administrator must install additional wireless LAN infrastructure to segment traffic between user groups or device groups. For example, to segment traffic between employee and guest VLANs, an IT administrator must install two access points at each location throughout an enterprise WLAN network (as shown in Figure 2). However, with the use of wireless VLANs, one access point at each location can be used to provide access to both groups.
Figure 2 User Segmentation Without Wireless VLANs
With VxWorks Firmware Release 12.00T or later and Cisco IOS® Software Release 12.2.4-JA or later, an 802.1Q trunk can be terminated on an access point (Cisco Aironet 1200, 1100, 350, or 340 Series) or on a bridge (Cisco Aironet 350 Series), allowing access up to 16 wired VLANs. A unique Service Set Identifier (SSID) defines a wireless VLAN on the access point and the bridge. Each SSID is mapped to a VLAN-ID on the wired side with a default SSID to VLAN-ID mapping. Additionally, with wireless LANs, a per-VLAN network security policy is defined on the access point and on the bridge by the IT administrator. Sections 3 and 4 discuss this in detail.
Wireless VLAN deployment is different for indoor and outdoor environments. For indoor deployments, the access point is generally configured to map several wired VLANs to the wireless LAN. For outdoor environments, 802.1Q trunks are deployed between bridges with each bridge terminating and extending as an 802.1Q trunk, participating in the 802.1d-based Spanning-Tree Protocol process.
Figure 3 shows an indoor wireless VLAN deployment scenario. Four wireless VLANs are provisioned across the campus to provide WLAN access to full-time employees (segmented into engineering, marketing, and human resources user groups) and guests.
Figure 3 Indoor Wireless VL
As shown in Table 1, each wireless VLAN is configured with an appropriate network security policy and mapped to a wired VLAN. An IT administrator enforces the appropriate network security policies within the wired network for each different user group.
Table 1 Configuration for Wireless VLANs in Figure 3
An outdoor wireless VLAN deployment scenario is shown in Figure 4. In this example, wireless trunking is used to connect the root bridge to the non-root bridges. The root and non-root bridges terminate the 802.1Q trunk and participate in the Spanning-Tree Protocol process of bridging networks together.
Figure 4 Outdoor Wireless VLANs Deployment
This section discusses the wireless VLAN features available with VxWorks Firmware Release 12.00T or later and Cisco IOS Software Release 12.2.4-JA or later. With these releases, an 802.1Q trunk can be enabled between the access point or bridge and the wired infrastructure, allowing up to 16 wired VLANs to be extended to the WLAN.
As discussed in Section 2.0, a per-VLAN network security policy can be defined on the access point to allow the IT administrator to define appropriate restrictions per VLAN. The following parameters are configurable on the SSID wireless VLAN:
- SSID name: Configures a unique name per wireless VLAN
- Default VLAN ID: Default VLAN-ID mapping on the wired side
- Authentication types: Open, shared, and network-Extensible Authentication Protocol (EAP) types
- Media Access Control (MAC) authentication: Under open, shared, and network-EAP
- EAP authentication: Under open and shared authentication types
- Maximum number of associations