Cisco Systems DL-2159-05 manual 5shows the wireless Vlan deployment scenario described above

Chapter 4 Configuring VLANs

A Wireless VLAN Deployment Example

•Maintenance workers use specialized hand-held devices to access information specific to maintenance issues (such as trouble tickets). They access the information from a server in an Application Servers VLAN. The handhelds only support static 40- or 128-bit WEP.

•Existing wired VLANs are localized per building and use Layer 3 policies to prevent users from accessing critical applications.

Using the information above, you could deploy wireless VLANs by creating four wireless VLANs as follows:

•A full-timeVLAN and a part-timeVLAN using IEEE 802.1x with dynamic WEP and TKIP features for WLAN access. User login is tied to the RADIUS server with a Microsoft back-end user database. This configuration enables the possibility of single sign-on for WLAN users.

•RADIUS-based SSID access control for both full-time and part-time employee WLAN access. Cisco recommends this approach to prevent part-time employees from VLAN hopping, such as trying to access the WLAN using the full-time VLAN.

Note In this deployment scenario, VLANs are localized per building, enabling users to access the WLAN from anywhere within the campus. Cisco recommends using SSID access control rather than using fixed VLAN ID assignment.

•A guest VLAN uses the primary SSID with open or no WEP access. Policies are enforced on the wired network side to force all guest VLAN access to an Internet gateway and denies access into the XYZ corporate network.

•A maintenance VLAN uses open with WEP plus MAC authentication. Policies are enforced on the wired network side to allow access only to the maintenance server on the application server’s VLAN.

Figure 4-5shows the wireless VLAN deployment scenario described above.

Figure 4-5 Wireless VLAN Deployment Example

SSID = Full-time AP_2

SSID = Part-time	Native VLAN = 10
	802.1Q Trunk

802.1Q Trunk

Management VLAN

(VLAN-id 10)

Management	RADIUS
VLAN	server
	81660

SSID = Maintenance

SSID = Guest

Cisco Aironet 1200 Series Access Point Software Configuration Guide

4-10 OL-2159-05