Different network addresses ssid

[Ed Lo]

Hello,

I want to make multiple SSID and want them all to have different network addresses. So all of them have different ip address ranges they give to the devices connected to them. Do I need to make a DHCP pool for each vlan assigned to an SSID?

thank you

[Georg Pauwen]

Hello Ed,

SSID is associated with the VLAN, not with the DHCP pool. If you need a different SSID for each VLAN, you just configure the DHCP pools for each VLAN, and then associate the SSID with the respective VLANs.

What hardware/devices are you trying to configure ?

[Ed Lo]

I'm using a cisco 1941w router and I was wondering if I needed to configure the dhcp pools for each vlan so that their respective SSID have different ip ranges.

[Georg Pauwen]

Ed,

yes. For each VLAN, a different DHCP pool, and then you can associate the SSIDs with the respective pools.

[Ed Lo]

Sorry, but you wouldn't happen to know the commands for associating a vlan with a dhcp pool would you? I've tried it on my own but when i connect to that ssid it doesn't give me an ip address.

Using an ssid named batman and vlan 2

This is my current config if it helps:

Current configuration : 1880 bytes
!
! Last configuration change at 19:07:35 UTC Thu Jul 27 2017
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
service-module wlan-ap 0 bootimage autonomous
!
!
!
!
!
!
!
!
!
!
!
ip dhcp excluded-address 192.168.12.1
ip dhcp excluded-address 192.168.12.0
!
ip dhcp pool batmanpool
import all
network 192.168.12.0 255.255.255.0
domain-name batman.com
default-router 192.168.12.1
dns-server 4.4.4.2 4.4.4.1
lease 7
!
!
!
!
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
cts logging verbose
!
!
!
!
!
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 10.10.10.1 255.255.255.0
duplex auto
speed auto
!
interface wlan-ap0
ip unnumbered Vlan1
arp timeout 0
no mop enabled
no mop sysid
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Wlan-GigabitEthernet0/0
switchport mode trunk
no ip address
!
interface Vlan1
ip address 10.10.0.30 255.255.255.0
!
interface Vlan2
ip address 192.168.12.1 255.255.255.0
!
interface Vlan4
no ip address
!
ip forward-protocol nd
!
ip http server
ip http authentication aaa
no ip http secure-server
!
!
!
!
access-list 11 permit 0.0.0.1 255.255.255.0
!
control-plane
!
!
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line 67
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
line vty 0 4
login
transport input none
!
scheduler allocate 20000 1000
!
end

[Georg Pauwen]

Ed,

your DHCP pool to VLAN mapping/configuration is fine. How did you associate the SSID with the VLAN ? Have a look at the document below (this is for an Aironet, but it should work in a similar fashion):

https://supportforums.cisco.com/document/55561/multiple-ssid-multiple-vlans-configuration-example-cisco-aironet-aps

[Georg Pauwen]

Hello,

actually the link to the previous post I sent you has an even better sample configuration (again, scroll down to Lukasz Bromirski's post):

https://supportforums.cisco.com/discussion/10927121/cisco-1941w-basic-configuration

[Ed Lo]

I took a look at that example and I did do it the way they show there but still nothing. I noticed that it mentions that the vlan have to be configured on the local switch but the router isn't connected to one so I've never seen the edge(config)# that it mentions.

Below is the config of the router from the ap# point of view. I don't know if you see anything wrong but it's not working right now so no ip is assigned when I connect a device to that SSID.

Current configuration : 3675 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ap
!
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid batman
vlan 2
authentication open
mbssid guest-mode
!
dot11 ssid robin
vlan 3
authentication open
mbssid guest-mode
!
!
!
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
ssid batman
!
ssid robin
!
antenna gain 0
mbssid
station-role root
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.1
encapsulation dot1Q 2
ip address 192.168.12.1 255.255.255.0
no ip route-cache
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
!
interface Dot11Radio0.2
encapsulation dot1Q 3
no ip route-cache
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
bridge-group 3 spanning-disabled
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router
no ip address
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface BVI1
ip address dhcp client-id GigabitEthernet0
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path
bridge 1 route ip
!
!
!
line con 0
privilege level 15
login local
no activation-character
line vty 0 4
login local
!
cns dhcp
end

[Georg Pauwen · Accepted solution]

Hello,

from what I can tell, you need to bridge the Vlans on the internal interface. Check the changes I made in bold:

Current configuration : 3675 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ap
!
no aaa new-model
!
dot11 syslog
!
dot11 ssid batman
vlan 2
authentication open
mbssid guest-mode
!
dot11 ssid robin
vlan 3
authentication open
mbssid guest-mode
!
bridge irb
!
interface Dot11Radio0
no ip address
no ip route-cache
!
ssid batman
!
ssid robin
!
antenna gain 0
mbssid
station-role root
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.1
encapsulation dot1Q 2
ip address 192.168.12.1 255.255.255.0
no ip route-cache
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
!
interface Dot11Radio0.2
encapsulation dot1Q 3
no ip route-cache
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
bridge-group 3 spanning-disabled
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0.2
encapsulation dot1q 2
no ip route-cache
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
!
interface GigabitEthernet0.3
encapsulation dot1q 3
no ip route-cache
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
bridge-group 3 spanning-disabled
!
ip http server
no ip http secure-server
ip http help-path
!
line con 0
privilege level 15
login local
no activation-character
line vty 0 4
login local
!
cns dhcp
end