 "Engineering" SSID to gain access to the wireless LAN, the RADIUS server maps John to VLAN-ID 24. This may or may not be the default VLAN-ID mapping for the "Engineering" SSID. Using this method, a user is mapped to a fixed wired VLAN throughout an enterprise network.
RADIUS-based SSID access control: David uses the "Marketing" SSID to gain access to the wireless LAN. However, the permitted SSID list sent back by the RADIUS server indicates that David is only allowed access to the "Engineering" SSID. Upon receipt of this information, the access point disassociates David from the wireless LAN network. Using this method, a user is given access to only one SSID or to predetermined SSIDs throughout an enterprise network.
Figure 6 RADIUS-Based VLAN Access Control
In order to properly deploy wireless VLANs, an IT administrator should evaluate the need for deploying wireless VLANs within their environment. Existing wired VLAN deployment rules and policies should be reviewed. Existing wired VLAN policies can be used as the basis for wireless VLAN deployment policies.
This section details selection criteria for wireless VLAN deployment, provides a deployment example, summarizes the of rules for wireless VLAN deployment, and provides best practices to use on the wired infrastructure when deploying wireless VLANs.
- Security mechanisms (Static WEP, MAC authentication, EAP authentication [LEAP, EAP-TLS or PEAP], virtual private network [VPN], and so on) supported by each device type
- Wired network resources (such as servers) commonly accessed by WLAN device groups
- QoS level needed by each device group (default CoS, voice CoS, and so on)
1. Segmentation by user groups: Segmentation of the WLAN user community and enforcement of specific access-security policies per user group. For example, three wired and wireless VLANs in an enterprise environment could be created for full-time employee, part-time employee and guest access.
2. Segmentation by device types: Segmentation of the WLAN to allow different devices with different access-security "levels" to access the WLAN. For example, it is not recommended to allow handheld computers that support only 40/128-bit static-WEP to co-exist with other WLAN client devices using 802.1X with dynamic WEP in the same VLAN. In this scenario, devices are grouped and isolated with different "levels" of access security into separate VLANs.
A wireless VLAN deployment example is outlined below. The IT administrator of company XYZ determines the need for wireless LANs in his network. Using the guidelines described in Section 4.1, his findings are as follows:
3. Full-time employees need full access to the wired network resources. The IT department has implemented application-level privileges for each user (using Microsoft Windows NT or Active Directory (AD) mechanisms).
4. Part-time employees are not allowed access to certain wired resources (such as human resource servers, data storage servers, and so on). Furthermore, the IT department has implemented application-level privileges for part-time employees (using Microsoft Windows NT or AD mechanisms).
6. Maintenance personal (electrical, facilities, and others) use specialized handheld computers that support static 40- or 128-bit encryption to access trouble ticket information via an application server VLAN.
1. Create "Full-Time" and "Part-Time" VLANsImplement 802.1X with dynamic WEP along with TKIP capability for WLAN access. Tie user login on the RADIUS server with Microsoft back-end user database to enable "single sign-on" for WLAN users.
Implement RADIUS-based SSID access control for both "Full-Time" and "Part-Time" employees to access WLAN. This is recommended to prevent part-time employees from VLAN "hopping" (for example, trying to access the WLAN using "Full-Time" VLAN).
Note: In this deployment scenario, VLANs are localized per building with user group mapping to wired VLAN-IDs different for each building. In order to enable users to access the WLAN from anywhere on campus, SSID access control is recommended rather than fixed VLAN-ID assignments