Multiple Security Profiles (SSIDs/Vlans) or Single SSIDs and Vlans

[msmarziali]

Hi All,

We have configured an acces points Aironet 1850i with image mobility express.

In my network i have 4 vlans.

The access point is connected to the switch with a trunk connection for all vlans.

We have configured radius authentication for all SSIDs: we have created a SSID (tagged) for each vlan.

In total now i have 4 SSID.

It is possible to have a configuration with a single SSID and then based on user authentication (if a member of a group) assign the vlanid ?

Which is the safest configuration?

Thank you in advance.

[Francesco Molino]

Hi

Yes you can have only 1 ssid and then based on user authentication, you can push them into a vlan. If you're in a flexconnect mode then you can assign a vlan. If you're in local mode (centralized mode), you can assign a radius attribute Airespace:Airespace-Interface-Name. This interface must be defined into your wlc.

[msmarziali]

Hi, we have not a wlc.

We use an aironet 1650i for wlc role.

We setup aironet by web wizard, but no find any reference to setup one ssid for multiple VLAN  and assign correct VLAN by NPS.

Is possible configure via web?

Web interfacce permit create WLAN(ssid) and assign a tag for VLAN, so we create multiple ssid that correspond to vlans.

Any reference?

Thanks a lot  for precious support.

[msmarziali]

Hi, we have not a wlc.

We use an aironet 1650i for wlc role.

We setup aironet by web wizard, but no find any reference to setup one ssid for multiple VLAN  and assign correct VLAN by NPS.

Is possible configure via web?

Web interfacce permit create WLAN(ssid) and assign a tag for VLAN, so we create multiple ssid that correspond to vlans.

Any reference?

Thanks a lot  for precious support.

[Francesco Molino]

Here a documentation showing how to do vlan assignment on an autonomous AP:
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116581-configure-dynamicvlan-00.html

[Sathiyanarayanan Ravindran]

Hi @msmarziali ,

Yes, You can assign VLAN via radius server based on the user group. Please refer the below links for ACS and NPS.

Dynamic Authorization using NPS on Cisco WLC

Dynamic Authorization using ACS on Cisco WLC