ultiple SSIDs are created with each SSID mapping to a default VLAN-ID on the wired side. However, as per 802.11 specifications, only one SSID can be broadcast in the beacons. The IT administrator defines a primary (Guest) SSID that is broadcast in the 802.11 beacon management frames. All other SSIDs are secondary SSIDs and are not broadcast in the 802.11 beacon management frames.
An IT administrator can also map the primary SSID to the VLAN-ID on the wired infrastructure in different ways. For example, in an enterprise rollout scenario, the primary SSID could be mapped to the unencrypted VLAN on the wired side to provide "Guest" VLAN access.
As discussed earlier, each SSID is mapped to a default VLAN-ID on the wired side. The IT administrator may wish to impose back end (such as RADIUS)-based VLAN access control using 802.1X or MAC address authentication mechanisms. For example, if the WLAN is set up such that all VLANs use 802.1X and similar encryption mechanisms for WLAN user access, then a user can "hop" from one VLAN to another by simply changing the SSID and successfully authenticating to the access point (using 802.1X). This may not be preferred if the WLAN user is confined to a particular VLAN.
1. RADIUS-based SSID access control: Upon successful 802.1X or MAC address authentication, the RADIUS server passes back the allowed SSID list for the WLAN user to the access point or bridge. If the user used an SSID on the allowed SSID list, then the user is allowed to associate to the WLAN. Otherwise, the user is disassociated from the access point or bridge.
2. RADIUS-based VLAN assignment: Upon successful 802.1X or MAC address authentication, the RADIUS server assigns the user to a predetermined VLAN-ID on the wired side. The SSID used for WLAN access doesn't matter because the user is always assigned to this predetermined VLAN-ID.
VLAN assignment: Both "Engineering" and "Marketing" VLANs are configured to only allow 802.1X authentication (LEAP, EAP-TLS, PEAP, and so on). As shown in Figure 6, when John uses the "Engineering" SSID to gain access to the wireless LAN, the RADIUS server maps John to VLAN-ID 24. This may or may not be the default VLAN-ID mapping for the "Engineering" SSID. Using this method, a user is mapped to a fixed wired VLAN throughout an enterprise network.
RADIUS-based SSID access control: David uses the "Marketing" SSID to gain access to the wireless LAN. However, the permitted SSID list sent back by the RADIUS server indicates that David is only allowed access to the "Engineering" SSID. Upon receipt of this information, the access point disassociates David from the wireless LAN network. Using this method, a user is given access to only one SSID or to predetermined SSIDs throughout an enterprise network.
Figure 6 RADIUS-Based VLAN Access Control
In order to properly deploy wireless VLANs, an IT administrator should evaluate the need for deploying wireless VLANs within their environment. Existing wired VLAN deployment rules and policies should be reviewed. Existing wired VLAN policies can be used as the basis for wireless VLAN deployment policies.
This section details selection criteria for wireless VLAN deployment, provides a deployment example, summarizes the of rules for wireless VLAN deployment, and provides best practices to use on the wired infrastructure when deploying wireless VLANs.
- Security mechanisms (Static WEP, MAC authentication, EAP authentication [LEAP, EAP-TLS or PEAP], virtual private network [VPN], and so on) supported by each device type
- Wired network resources (such as servers) commonly accessed by WLAN device groups
- QoS level needed by each device group (default CoS, voice CoS, and so on)
1. Segmentation by user groups: Segmentation of the WLAN user community and enforcement of specific access-security policies per user group. For example, three wired and wireless VLANs in an enterprise environment could be created for full-time employee, part-time employee and guest access.
2. Segmentation by device types: Segmentation of the WLAN to allow different devices with different