Static and MAC based VLAN in combination on WiFi

OWB · January 2023

Hi,

I have serval clients connecting to a wireless LAN. I want some of the clients to be located on a specific VLAN. Today it's soved by having two wirelsess networks / SSID's, one for each respective VLAN. However I would like to avoid more SSID's if possible.

I have tried to solve it by using MAC based VLAN in combination with static VLAN, but cant get it to work, if possible at all.

The setup is.

VPN100 router/firewall
GS2220 switch
WAC6303D-S AP

In the switch static VLANs is configured as follows:

Static VLAN PVID1
WiFi AP port 1, fixed, no TX Tagging
Router / switch uplink port 24, fixed, TX Tagging

Static VLAN10 PVID10
WiFi AP port 1, normal, no TX Tagging
Router / switch uplink port 24, fixed, TX Tagging

Besides that, MAC based VLAN is configured with:

MAC 1A:2B:3C:4D:5E:6F, VID10, Priority 1

Image: https://us.v-cdn.net/6029482/uploads/editor/tm/b6tmki2w1zbz.png

Connected clients not found in the MAC based VLAN table reciewss IP's from PVID1, but clients found in the MAC based VLAN table dosent reciewe IP's at all.

Is it possible to achive the discribed scenario, and if so, what am I doing wrong?

Best regards Ole.

Zyxel_Judy · February 2023

Hi @OWB,

Based on your topology, you can refer to the steps below to configure the Dynamic VLAN in on-Premise mode.

I. VNP100 configuration

1. Configure Interface: CONFIGURATION > Network > Interface > VLAN. Click Add to create a new VLAN configuration.

Image: https://us.v-cdn.net/6029482/uploads/editor/tv/uy8f4bd7blv9.png

In General Settings, check Enable and enter the VLAN information (e.g: VLAN10, 20)

Image: https://us.v-cdn.net/6029482/uploads/editor/bu/w5m5zfwe2dr8.png

2. Configure AP Profile

CONFIGURATION > Object > AP Profile > SSID > Security List, select the default AP profile and edit.

Image: https://us.v-cdn.net/6029482/uploads/editor/z3/1259mwf3rz2t.png

CONFIGURATION > Object > AP Profile > SSID > SSID List, and select the default AP profile and edit.

Image: https://us.v-cdn.net/6029482/uploads/editor/mi/bbr2qi1ha42t.png

CONFIGURATION > Wireless > AP Management > AP Group, select the default AP profile and edit.

3. Configure RADIUS server info.

CONFIGURATION > Object > AAA Server > RADIUS, click #1 radius, and edit.

CONFIGURATION > Object > Auth. Method, click #1 default, and edit.

II. GS2220 configuration

Advanced Application > VLAN > VLAN Configuration > Static VLAN setup (e.g: VLAN10, 20)

Image: https://us.v-cdn.net/6029482/uploads/editor/oj/9848uyd59xlo.png

III. RADIUS server configuration

Configure the VPN100 info.

Configure User with password and three attribute needed to add: Tunnel Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID

Verification:

Use mobile phone to connect with SSID DyVlan. Enter the Username and Password which are in VLAN 10/ VLAN20 group, and then click Join to connect with the AP. The logged-in client gets an IP in VLAN10/ VLAN20.

Zyxel_Melen · January 2023

Hi @OWB,

Thanks for asking.

I recommend you use the 802.1x with dynamic VLAN on the SSID setting and set up a Radius server to fulfill your requirement.

May I know does your AP in standalone mode or Nebula mode? So I can provide you with the setup guide for the mode you are using.

OWB · January 2023

Hi,

Thanks a lot for your feedback!

OK, can that be achieved without further components to the network?

AP is in standalone mode, but managed from the ZyWALL

BR O

Zyxel_Melen · January 2023

Hi @OWB,

Thanks for sharing the information. We will provide you with the solution after doing a lab for confirmation.
Additionally, you will need to add a Radius server for this solution.

Zyxel_Judy · January 2023

Hi @OWB,

In Controller managed mode with your typology, to let some of the clients to be located on a specific VLAN with one SSID, you need to have a RADIUS server to do authentication.

To implement your scenario without further components to the network, recommend you use the cloud mode (Zyxel Nebula), you can configure dynamic VLAN with Nebula Cloud Authentication Server. Please refer to this link: https://community.zyxel.com/en/discussion/15667

OWB · January 2023

To implement your scenario without further components to the network, recommend you use the cloud mode (Zyxel Nebula), you can configure dynamic VLAN with Nebula Cloud Authentication Server. Please refer to this link: https://community.zyxel.com/en/discussion/15667

Nebula is not a possible solution for me in this case, sorry.

OWB · January 2023

Zyxel_Melen said:

Hi @OWB,

Thanks for sharing the information. We will provide you with the solution after doing a lab for confirmation.
Additionally, you will need to add a Radius server for this solution.

Thanks a lot, I will await the solution.

Best regards Ole

Zyxel_Judy · February 2023

Hi @OWB,

Based on your topology, you can refer to the steps below to configure the Dynamic VLAN in on-Premise mode.

I. VNP100 configuration

1. Configure Interface: CONFIGURATION > Network > Interface > VLAN. Click Add to create a new VLAN configuration.

In General Settings, check Enable and enter the VLAN information (e.g: VLAN10, 20)

2. Configure AP Profile

CONFIGURATION > Object > AP Profile > SSID > Security List, select the default AP profile and edit.

CONFIGURATION > Object > AP Profile > SSID > SSID List, and select the default AP profile and edit.

CONFIGURATION > Wireless > AP Management > AP Group, select the default AP profile and edit.

3. Configure RADIUS server info.

CONFIGURATION > Object > AAA Server > RADIUS, click #1 radius, and edit.

CONFIGURATION > Object > Auth. Method, click #1 default, and edit.

II. GS2220 configuration

Advanced Application > VLAN > VLAN Configuration > Static VLAN setup (e.g: VLAN10, 20)

III. RADIUS server configuration

Configure the VPN100 info.

Configure User with password and three attribute needed to add: Tunnel Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID

Verification:

Use mobile phone to connect with SSID DyVlan. Enter the Username and Password which are in VLAN 10/ VLAN20 group, and then click Join to connect with the AP. The logged-in client gets an IP in VLAN10/ VLAN20.

OWB · February 2023

Thanks alot!

Could you provide me the name of the Radius server product used in the configuration example?

Best regards Ole

Zyxel_Judy · February 2023

Hi @OWB,

We used TekRADIUS LT Manager to implement the LAB.In case you need to have more advanced feature, you can refer to Window server.

Static and MAC based VLAN in combination on WiFi

Accepted Solution

All Replies

Categories

Wireless Help Center