 deployed between bridges with each bridge terminating and extending as an 802.1Q trunk, participating in the 802.1d-based Spanning-Tree Protocol process.
Figure 3 shows an indoor wireless VLAN deployment scenario. Four wireless VLANs are provisioned across the campus to provide WLAN access to full-time employees (segmented into engineering, marketing, and human resources user groups) and guests.
Figure 3 Indoor Wireless VL
As shown in Table 1, each wireless VLAN is configured with an appropriate network security policy and mapped to a wired VLAN. An IT administrator enforces the appropriate network security policies within the wired network for each different user group.
Table 1 Configuration for Wireless VLANs in Figure 3
An outdoor wireless VLAN deployment scenario is shown in Figure 4. In this example, wireless trunking is used to connect the root bridge to the non-root bridges. The root and non-root bridges terminate the 802.1Q trunk and participate in the Spanning-Tree Protocol process of bridging networks together.
Figure 4 Outdoor Wireless VLANs Deployment
This section discusses the wireless VLAN features available with VxWorks Firmware Release 12.00T or later and Cisco IOS Software Release 12.2.4-JA or later. With these releases, an 802.1Q trunk can be enabled between the access point or bridge and the wired infrastructure, allowing up to 16 wired VLANs to be extended to the WLAN.
As discussed in Section 2.0, a per-VLAN network security policy can be defined on the access point to allow the IT administrator to define appropriate restrictions per VLAN. The following parameters are configurable on the SSID wireless VLAN:
- SSID name: Configures a unique name per wireless VLAN
- Default VLAN ID: Default VLAN-ID mapping on the wired side
- Authentication types: Open, shared, and network-Extensible Authentication Protocol (EAP) types
- Media Access Control (MAC) authentication: Under open, shared, and network-EAP
- EAP authentication: Under open and shared authentication types
- Maximum number of associations: Ability to limit maximum number of WLAN clients per SSID
Note: The IT administrator must define a unique encryption key per VLAN. This is discussed more in detail in Section 3.2.
- Enhanced Message Integrity Check (MIC) verification for WEP: Enables MIC per VLAN. This is a component of the Cisco Wireless Security Suite.
- Temporal Key Integrity Protocol (TKIP): Enables per-packet key hashing per VLAN. This is a component of the Cisco Wireless Security Suite.
- WEP (broadcast) key rotation interval: Enables broadcast WEP key rotation per VLAN. This is only supported for wireless VLANs with IEEE 802.1X EAP protocols enabled (such as EAP Cisco Wireless [LEAP], EAP-Transport Layer Security [EAP-TLS], Protected Extensible Authentication Protocol [PEAP], and EAP-Subscriber Identity Module [EAP-SIM]). This is a component of the Cisco Wireless Security Suite.
- Default policy group: Applies policy group (set of Layer 2, 3, and 4 filters) per VLAN. Each filter (within a policy group) is configurable to allow or deny certain types of traffic.
- Default priority: Applies default class of service (CoS) priority per VLAN.
With an encryption key configured, the VLAN supports standardized WEP. However, Cisco TKIP, MIC, and broadcast key rotation features are optionally configurable as noted above. Table 2 lists the SSID and VLAN-ID configuration parameters.
Table 2 SSID and VLAN-ID Configuration Parameters
|SSID Parameter||VLAN-ID Parameter|
|Maximum number of associations|
|Encryption key (broadcast key)|
|WEP (broadcast) key rotation interval|
|Default priority (CoS mapping)|
All Layer 2 broadcast and multicast wireless LAN messages are propagated over the air. Thus, each WLAN client receives broadcast and multicast traffic belonging to different VLANs. This is different from wired VLAN broadcast and multicast traffic.
With wired LANs, a wired client receives Layer 2 broadcast or multicast traffic for its own VLAN only. Thus, a unique encryption (broadcast or multicast) key per VLAN is used to segment the Layer 2 broadcast 