Cisco WLC Single SSID Multiple Vlan - open authentication

[Jay Russell Santos]

Hi Experts,

I'm setting up a wireless infra. I would have Single SSID with multiple users (different company). The WLAN is open authentication, that's where the problem is. We want some separation of some sort. Preferably, different users should be on different vlan. I know there's a way to do this by implementing Dynamic Vlan. However, this one is open authentication.

Is there a way to do it?

Thanks.

[Ric Beeching]

With no authentication not really as you'd need some form of identifier with which to assign a user to a particular VLAN.

The only way to separate them with this setup and assuming you have Cisco APs/WLAN Controller would be to use WLAN VLAN Mappings with FlexConnect groups which would at least restrict the VLAN to per WAP.. but that's not really achieving company separation.

[JASON BOYERS]

You could do something using MAC filtering with RADIUS, having the RADIUS server send back the VLAN based on the MAC.  That's much easier using a RADIUS server like ISE or ACS than Microsoft NPS.  Other than that, you don't have any way of differentiating users if it is completely open, since the MAC is the only information available.