topic Re: Same SSID on multiple sites with NPS in Wireless

Same SSID on multiple sites with NPS

Jérôme — Fri, 24 Feb 2023 13:01:24 GMT

Hi,

We have configured an SSID with enterprise security with Microsoft NPS radius and override VLAN TAG. It's our radius server which, depending on the PC group, assigns the Tunnel-PVT-GROUP-ID.

Example: my SSID is called WIFI_TEST

if my pc belongs to the AD WIFI-SERVICE1 group, the radius gives it VLAN 75
if my pc belongs to the AD WIFI-SERVICE2 group, the radius gives it VLAN 76
if my pc belongs to the AD WIFI-SERVICE3 group, the radius gives it VLAN 77

It works fine on a single site.

We have other remote sites in MPLS. How can we duplicate this configuration on our other sites knowing that we cannot route the same VLAN IDs? Is it possible to mix in the same configuration of SSID Radius Override and VLAN tagging for remote sites? Can we put several Tunnel-PVT-GROUP-ID on the radius server. How did you do ?

Regards...

Re: Same SSID on multiple sites with NPS

aleabrahao — Fri, 24 Feb 2023 13:33:17 GMT

You can use Called-Station-ID:

It Contains (1) the Meraki access point's BSSID (all caps, octets separated by hyphens) and (2) the SSID on which the wireless device is connecting. These 2 fields are separated by a colon. Example: "AA-BB-CC-DD-EE-FF:SSID_NAME".

https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#Supported_RADIUS_Attributes

Re: Same SSID on multiple sites with NPS

GreenMan — Fri, 24 Feb 2023 14:55:06 GMT

Why can't you re-use the same VLAN IDs? Assuming you are not interconnecting your sites at Layer-2, it's very common to use exactly the same VLAN ID for the same service / user group at different sites in a WAN.

Support for the RADIUS server returning a VLAN name (rather than an ID) is a part of future planning, but I haven't seen a date for that, as yet.

Re: Same SSID on multiple sites with NPS

Jérôme — Mon, 27 Feb 2023 10:26:43 GMT

Hi,

Thank you for yours answers.

@alessandrodematos I had not thought of the Called-Station-ID, it's un good idea. We have more than 100APs on our remote sites, it will take a long time to configure.

@GreenMan I think it's not possible with MPLS. Our ISP doesn't know how to do

Re: Same SSID on multiple sites with NPS

jacek.jagielka — Tue, 28 Feb 2023 12:35:59 GMT

You would need to set up different clients (APs) in the NPS, so you can easily differentiate between them in the NPS.

Lets say you call the clients SITE1-WIFI and SITE2-WIFI with the IP ranges of the respective AP's.

Then in the NPS you can set up policies and use "Client Friendly Name" with a value of "SITE1*" - this will affect only requests coming from APs that are in SITE1 and so on.

I hopefully understood your question correctly 😉