Cisco Systems DL-2159-05 manual Guidelines for Wireless Vlan Deployment

Chapter 4 Configuring VLANs

Guidelines for Wireless VLAN Deployment

Creating an SSID for Infrastructure Devices

You must map the native VLAN to an SSID for infrastructure devices (such as workgroup bridges and repeaters) so that they can communicate in the VLAN environment. Follow these steps.

Step 1 From the Setup page, click Service Sets.

Step 2 Create a new SSID called Infrastructure and map it to the Native VLAN.

Step 3 Return to the AP Radio Service Sets page. Highlight Infrastructure in the Existing SSIDs field.

Step 4 In the Disallow Infrastructure Stations on any other SSID field, click Yes.

Guidelines for Wireless VLAN Deployment

You may want to consider these and guidelines before you deploy wireless VLANs on your network:

•The switch must be capable of providing an IEEE 802.1Q trunk between it and the access point.

•A maximum of 16 VLANs per ESS are supported; each wireless VLAN is represented with a unique SSID.

•Each VLAN must be configured with a unique encryption key.

•Only one unencrypted VLAN per ESS is permitted.

•Only one primary SSID per ESS is supported.

•TKIP/MIC/Broadcast key rotation can be enabled for each VLAN.

•Open, Shared-Key, MAC, Network-EAP (LEAP), and EAP configuration types can be configured on each SSID.

•Shared-Key authentication is supported only on the SSID mapped to the native VLAN (this is most likely to be the Infrastructure SSID).

•A unique policy group (a set of Layer 2, Layer 3, and Layer 4 filters) is allowed for each VLAN.

•Each SSID is mapped to a default wired VLAN with an ability to override its SSID to VLAN ID using RADIUS-based VLAN access control mechanisms.

•RADIUS-based VLAN ID assignment per user is supported.

•RADIUS-based SSID access control per user is supported.

•Assigning a CoS mapping per VLAN is permitted (8 priority levels are supported).

•The number of clients per SSID is controllable.

•All access points and bridges in the same ESS must use the same native VLAN ID in order to facilitate IAPP communication between them.

Wireless LAN security policies can be mapped to the wired LAN switches and routers.

Cisco Aironet 1200 Series Access Point Software Configuration Guide

OL-2159-05 4-21