topic Re: Mearki WAP - number of SSID limitations and Key management for large deployments in Cloud Networking Platform

Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Thu, 02 May 2019 16:46:14 GMT

Hello All,

Im working on a deployment design where I'm expecting long term users.

It will be like a Hotel environment where each room needs SSID ( considering security I feel it will be good provide separate SSID's) Im expecting around 60 rooms all of them with multiple devices.

May be 1 AP' for 4 rooms ( 15 AP's 60 rooms) for and apply some bandwidth restriction on these SSID's to make sure everyone gets fair bandwidth

My questions are

1. is it good to have many SSID's , does it impact AP performance?

2. How do I manage the keys - ( example on boarding a new person's devices, how to change the keys etc..) is there a separate solution for that?

Thanks

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

kYutobi — Thu, 02 May 2019 16:55:05 GMT

1. Too many SSID's causes overhead.

https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Multi-SSID_Deployment_Considerations

2. If you go to Wireless - Access Control you can see all the options there. From what you're telling me I think setting up a "Splash Page" with Meraki authentication would be a good option for you. You can use 1 SSID and control users by either having them sign up or making an email you can assign them.

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

BrechtSchamp — Thu, 02 May 2019 16:57:34 GMT

I think it's a bad idea to setup an SSID per room. Each SSID that is on a channel increases the amount of overhead. So the recommendation is to keep the number of SSIDs per AP to 3 or 4 maximum.

You could create either a NAT-mode SSID, or a bridge mode SSID with LAN 2 isolation activated? That way they can't reach each other. You can still assign per-client bandwidth limits for the users.

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Dylan_YYC — Thu, 02 May 2019 16:57:58 GMT

I wouldn't recommend doing so many SSID's. Anything more then 4 SSID per AP and you're going to start seeing significant speed impacts, it also does nothing for security. TBH i would run 1 or 2 SSID's with the AP's set to L2 LAN isolation. That way devices cant talk to each other even if they are connected to the same SSID.

As for key management, that can be a fun one. Depending on how your environment is setup, and who owns the devices you may want to consider a captive portal with 802.1X authentication or just use a PSK.

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

GuilhermeMacedo — Thu, 02 May 2019 17:22:33 GMT

Hi @Stanly glade to answer you question.

I sow your scenary more like a single SSID for all your rooms and to all your guests use a per room authentication. (and more one SSID if you need a corporate SSID for your team, as you need.)

Then you are able to use Meraki Autentication method for free and this will give you a chance to create many users/room. So every room has a user and a password that can be setup at right moment that your guest are in your lobby doing the checking. How this sounds to you?

So answering more especifically your question:

1 - Use more than 3 SSIDs at the same time in your deployments can cause some decrease performance of your Wlan see more at: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Multi-SSID_Deployment_Considerations

2 - Using a Meraki Authentication, you'll easily create and reset a user/room in real time. See more at: https://documentation.meraki.com/MR/Encryption_and_Authentication/Managing_User_Accounts_using_Meraki_Authentication

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Thu, 02 May 2019 17:27:18 GMT

Thanks Dylan.

If I have to go with 2 or 3 SSID's , can I still have separate Keys for each room?

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Thu, 02 May 2019 17:32:05 GMT

@GuilhermeMacedo

Thanks for your guidance.

Could you please give me some inputs links to how to configure the authentication for user/room

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

GuilhermeMacedo — Thu, 02 May 2019 17:54:15 GMT

Theres no much more than @kYutobi said, but you can follow this KB Managing User Accounts using Meraki Authentication.

hope was help!

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Nolan H. — Thu, 02 May 2019 19:37:54 GMT

@BrechtSchamp wrote:
I think it's a bad idea to setup an SSID per room. Each SSID that is on a channel increases the amount of overhead. So the recommendation is to keep the number of SSIDs per AP to 3 or 4 maximum.
You could create either a NAT-mode SSID, or a bridge mode SSID with LAN 2 isolation activated? That way they can't reach each other. You can still assign per-client bandwidth limits for the users.

Technically its the same amount of overhead if each AP is broadcasting only its unique SSID.

1 SSID on 10 access points, vs 10 SSID's, but each one only broadcasting on each individual AP, is the same overhead. Still just a single SSID from each AP at the end of the day. It's a terrible idea of course, and roaming won't work, but that is another issue all together 😃

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Thu, 02 May 2019 19:47:30 GMT

If I have to go with multiple SSID's like Tentats, Management and support on different channels do you see a challenge in roaming?

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

BrechtSchamp — Thu, 02 May 2019 20:00:06 GMT

@Nolan Herring agreed, but I was talking about having more than 3-4 SSIDs per AP. Having a single AP per room might also be challenging with regards to co-channel contention...

@Stanly you can't configure more than 15 SSIDs in a single network. So you would have to split up into different networks. But anyway, it's a bad idea :P.

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Brandon Svec — Thu, 02 May 2019 20:13:38 GMT

@Stanly Had you seen this in the Meraki Marketplace? https://apps.meraki.io/details/aerwave/

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Philip D'Ath — Thu, 02 May 2019 22:19:23 GMT

I would use a single SSID.

Have you considered using any of the billing options?

https://documentation.meraki.com/MR/Splash_Page/Billing_for_Wireless_Access

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Fri, 03 May 2019 04:50:57 GMT

Hey Philip

I dont need to bill the users, my concern is on the key management. How do I on/off board them , the users might remain in this location/room for a few months

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Philip D'Ath — Fri, 03 May 2019 22:02:37 GMT

You don't need to actually charge/bill the customer. You would use the "Use fast prepaid login page" option. Check out thsi documentation:

https://documentation.meraki.com/MR/Splash_Page/Customizing_Splash_Pages_for_Fast_Prepaid_Card_Billing_SSIDs

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Sat, 25 May 2019 17:43:53 GMT

Hello all,

First of all thanks to everyone for providing your inputs.

Im approaching this solution with some changes.

I'm planning to install MR30H in each apartment , Can I create a single SSID for all apartments for example "Tenants"
and create separate VLAN for each apartments?

as it is a single SSID can I contain Broadcast and multicast in this ?

There are common areas like pool and Gym, as the Tenants move with their devices Do you recommend to create a separate SSID for roaming? Could you please provide some best practices?

Thanks

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Philip D'Ath — Sat, 25 May 2019 23:56:40 GMT

I would be tempted to look at the Splash Access "Business Co-working" solution.

https://www.splashaccess.com/splashaccess-co-working-office/

This allows you to have one SSID but put each group of users into their own seperate VLANs. It allows them to roam all over the complex as a result.

You can achieve the same thing using group policy - but you'll need to assign the group policy to each client device before they can use it.

Re: Mearki WAP - number of SSID limitations and Key management for large deployments

Stanly — Sun, 26 May 2019 00:46:26 GMT

Thanks Philip.

That's a great suggestion. I will go through that link.