: Ability to limit maximum number of WLAN clients per SSID
Note: The IT administrator must define a unique encryption key per VLAN. This is discussed more in detail in Section 3.2.
- Enhanced Message Integrity Check (MIC) verification for WEP: Enables MIC per VLAN. This is a component of the Cisco Wireless Security Suite.
- Temporal Key Integrity Protocol (TKIP): Enables per-packet key hashing per VLAN. This is a component of the Cisco Wireless Security Suite.
- WEP (broadcast) key rotation interval: Enables broadcast WEP key rotation per VLAN. This is only supported for wireless VLANs with IEEE 802.1X EAP protocols enabled (such as EAP Cisco Wireless [LEAP], EAP-Transport Layer Security [EAP-TLS], Protected Extensible Authentication Protocol [PEAP], and EAP-Subscriber Identity Module [EAP-SIM]). This is a component of the Cisco Wireless Security Suite.
- Default policy group: Applies policy group (set of Layer 2, 3, and 4 filters) per VLAN. Each filter (within a policy group) is configurable to allow or deny certain types of traffic.
- Default priority: Applies default class of service (CoS) priority per VLAN.
With an encryption key configured, the VLAN supports standardized WEP. However, Cisco TKIP, MIC, and broadcast key rotation features are optionally configurable as noted above. Table 2 lists the SSID and VLAN-ID configuration parameters.
Table 2 SSID and VLAN-ID Configuration Parameters
|SSID Parameter||VLAN-ID Parameter|
|Maximum number of associations|
|Encryption key (broadcast key)|
|WEP (broadcast) key rotation interval|
|Default priority (CoS mapping)|
All Layer 2 broadcast and multicast wireless LAN messages are propagated over the air. Thus, each WLAN client receives broadcast and multicast traffic belonging to different VLANs. This is different from wired VLAN broadcast and multicast traffic.
With wired LANs, a wired client receives Layer 2 broadcast or multicast traffic for its own VLAN only. Thus, a unique encryption (broadcast or multicast) key per VLAN is used to segment the Layer 2 broadcast domains on the wireless LAN. This unique encryption key must be configured during initial VLAN setup. If broadcast key rotation is enabled, this encryption key is generated dynamically and delivered to WLAN clients in 802.1X messages.
The requirement to segment broadcast domains on the wireless side restricts the use of unencrypted VLAN per WLAN Extended Sub System (ESS). A maximum of one VLAN can be unencrypted per WLAN ESS. Also, the behavior of a WLAN client on an encrypted VLAN should lead to the discarding of unencrypted Layer 2 broadcast or multicast traffic.
The access point or the bridge native VLAN (the default VLAN) must be set to the native VLAN of the wired trunk. This allows the access point or bridge to receive and communicate using the Inter-Access Point Protocol (IAPP) with other access points or bridges in the same wireless LAN ESS.
It is a requirement that all access points and bridges in an ESS must use the same native VLAN-ID. All Telnet and http management traffic as well as the Remote Authentication Dial-In User Service (RADIUS) server traffic is routed to the access point via the native VLAN. Cisco recommends that IT managers restrict user access to the default VLAN of the access points and bridges by using Layer 3 access control lists (ACLs) and policies on the wired infrastructure side.
Figure 5 illustrates the combined deployment of infrastructure devices (such as workgroup bridges, non-root bridges, and repeaters) along with non-infrastructure devices (such as WLAN clients) in an enterprise WLAN. Native VLAN of the access point is mapped to the "Infrastructure" SSID. WEP encryption along with TKIP (at least per-packet key hashing) should be turned on for the "Infrastructure" SSID. Configuration of a secondary SSID as the "Infrastructure" SSID is also recommended. The concepts of primary and secondary SSIDs are explained in the next section.
Figure 5 Combined Deployment of Infrastructure and Non-Infrastructure Devices
When enabling multiple wireless VLANs on the access point or bridge, m