.
2. Create a "Guest" VLAN: Implement open/no WEP access with a broadcast SSID by using the primary SSID for "Guest" VLAN. Enforce policies on the wired network side to force all "Guest" VLAN access to an Internet gateway and deny access into the corporate network.
3. Create a "Maintenance" VLANImplement open/with WEP plus MAC authentication for this VLAN. Enforce policies on the wired infrastructure to only allow access to the maintenance server on the application server's VLAN.
Figure 7 Wireless VLAN Deployment Example
Table 3 Configuration for VLANs in Figure 7
|SSID||VLAN-ID||Security Policy||RADIUS-Based VLAN Access Control|
1. Limit broadcast and multicast traffic to the access point and bridge by enabling VLAN filtering and Internet Group Management Protocol (IGMP) snooping on the switch ports. On the 802.1Q trunks to the access point and bridge, filter to allow only active VLANs in the ESS. Enabling IGMP snooping prevents the switch from flooding all switch ports with Layer 3 multicast traffic.
3. The access point does not support Virtual Terminal Protocol (VTP) or Generic Attribute Registration Protocol VLAN Registration Protocol (GVRP) protocols for dynamic management of VLANs because the access point acts as a "stub" node. The IT administrator must use the wired infrastructure to maintain and manage the wired VLANs.
- The IT administrator could implement ACLs on the wired infrastructure to force all "guest" VLAN traffic to the Internet gateway.
- The IT administrator should restrict user access to the native/default VLAN of the access points and bridges with the use of Layer 3 ACLs and policies on the wired infrastructure.
- Example: Traffic to access points and bridges via the native/default VLAN is only allowed to and from the management VLAN where all the management servers including the RADIUS server reside.
Figure 8 Main Setup Page
Figure 9 Main VLAN Set Up Page
Figure 10 Native VLAN Configuration
Figure 11 Enabling 802.1Q Trunking
Figure 12 802.1Q Encapsulation Mode
Figure 13 "Guest" VLAN Configuration
Figure 14 Enabling the Unencrypted VLAN
Figure 15 Encrypted VLAN Configuration
Figure 16 List of VLANs
Figure 17 VLAN Summary Status Table
11. Figure 18. Click on Setup > Service Sets. (This is the same screen as shown in Step 1 of this Appendix.) The SSIDs lists are configurable per radio. On a Cisco Aironet 1200 Series Access Point with two radios, 802.11b radio SSIDs are referred to as "Internal" SSIDs and 802.11a radio SSIDs are referred to as "Module" SSIDs.
Figure 18 Main Setup Page
Figure 19 Access Point Radio Internal Service SetsPrimary SSID
Figure 20 Access Point Radio Internal Primary SSID Configuration
Figure 21 Creating a Secondary SSID
Figure 22 Secondary SSID "Open_WEP" Configuration
16. Figure 23. Create an SSID for infrastructure devices: Map the native VLAN of the access point to this SSID in order to allow infrastructure devices (such as workgroup bridges and repeaters) to associate to the access point using this SSID.
Figure 23 SSID for Infrastructure Devices
17. Figure 24. Infrastructure SSID configuration: Set the index of the SSID created in Step 16 as the "Infrastructure" SSID. Disallow all infrastructure devices on non-Infrastructure SSIDs (recommended).
Figure 24 Infrastructure SSID Configuration
Figure 25 Internal Service Set Summary Status Table
6 Appendix B: VLAN Configuration Example for Cisco IOS Software Release 12.2.4-JA for Cisco Aironet 1100 Series Access Point
Figure 26 "Guest" SSID Configuration
Figure 27 Enabling 802.1Q Trunking
Figure 28 Creating the Default VLAN
3. Figure 29. Set the native VLAN-ID: Click on Services > VLAN. Set the default VLAN-ID (native VLAN-ID) of the Cisco Aironet 1100 Series Access Point. A WARNING message will be displayed, click "OK."
Figure 29 Set the Default (Native) VLAN-ID
Figure 30 Creation of VLAN-ID 12
Figure 31 List of Active VLANs
Figure 32 Create and Map SSIDs to the Active VLANs
Figure 33 Example SSID to VLAN ID Mapping
Figure 34 Setting the Guest (Primary) SSID
9. Figure 35. Create an Infrastructure SSID and map to native VLAN (if