5

I have a little problem to realize a AP solution on a small office environment. At first I do not have any skills in configuring Cisco Access Points ;)

I have the following environment: A small office about 15 people and a network which is segmented into 2 VLANs (VLAN100 for clients and RADIUS server and VLAN200 for guests with very restricted access. The AP is connected on a L3 switch port with access on both VLANs.

Now if someone uses the AP, an authentication is required over the RADIUS server in VLAN100. On the RADIUS server I configured the NPS server role (Windows Server 2008R2) with 2 network policies (for each VLAN one policy) to grant access by successfull authentication.

Finally I have the problem if someone authenticates himself by using a guest account, he gets no network connectivity cause he does not know the VLAN. - Are there best practice tutorials for CISCO APs with RADIUS and VLANs or something like that, maybe someone has a better idea to realize that authentication/VLAN tagging procedure?


Ok here is the config, maybe I made a mistake:

Current configuration : 4225 bytes
!
! Last configuration change at 01:17:55 +0100 Mon Mar 1 1993
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AP01
!
!
logging rate-limit console 9
!
aaa new-model
!
!
aaa group server radius rad_eap
 server 172.0.0.30
!
aaa authentication login eap_methods group rad_eap
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
clock timezone +0100 1 0
no ip routing
no ip cef
ip domain name domain.local
ip name-server 172.0.0.31
ip name-server 172.0.0.30
ip name-server 172.0.0.28
!
!
!
no dot11 syslog
!
dot11 ssid WLAN-SSID
   vlan 100
   authentication open eap eap_methods
   authentication key-management wpa version 2
   mbssid guest-mode
!
!
power inline negotiation prestandard source
crypto pki token default removal timeout 0
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 100 mode ciphers aes-ccm
 !
 encryption mode ciphers aes-ccm
 !
 encryption vlan 200 mode ciphers aes-ccm
 !
 ssid WLAN-SSID
 !
 antenna gain 0
 stbc
 beamform ofdm
 mbssid
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 bridge-group 100 subscriber-loop-control
 bridge-group 100 spanning-disabled
 bridge-group 100 block-unknown-source
 no bridge-group 100 source-learning
 no bridge-group 100 unicast-flooding
!
interface Dot11Radio0.200
 encapsulation dot1Q 200
 no ip route-cache
 bridge-group 200
 bridge-group 200 subscriber-loop-control
 bridge-group 200 spanning-disabled
 bridge-group 200 block-unknown-source
 no bridge-group 200 source-learning
 no bridge-group 200 unicast-flooding
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 100 mode ciphers aes-ccm
 !
 encryption mode ciphers aes-ccm
 !
 encryption vlan 200 mode ciphers aes-ccm
 !
 ssid WLAN-SSID
 !
 antenna gain -128
 no dfs band block
 stbc
 beamform ofdm
 mbssid
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 bridge-group 100 subscriber-loop-control
 bridge-group 100 spanning-disabled
 bridge-group 100 block-unknown-source
 no bridge-group 100 source-learning
 no bridge-group 100 unicast-flooding
!
interface Dot11Radio1.200
 encapsulation dot1Q 200
 no ip route-cache
 bridge-group 200
 bridge-group 200 subscriber-loop-control
 bridge-group 200 spanning-disabled
 bridge-group 200 block-unknown-source
 no bridge-group 200 source-learning
 no bridge-group 200 unicast-flooding
!
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface GigabitEthernet0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 bridge-group 100 spanning-disabled
 no bridge-group 100 source-learning
!
interface GigabitEthernet0.200
 encapsulation dot1Q 200
 no ip route-cache
 bridge-group 200
 bridge-group 200 spanning-disabled
 no bridge-group 200 source-learning
!
interface BVI1
 ip address 172.0.10.5 255.255.255.0
 no ip route-cache
!
interface BVI100
 ip address dhcp
 no ip route-cache
!
interface BVI200
 ip address dhcp
 no ip route-cache
!
ip default-gateway 172.0.10.250
ip forward-protocol nd
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
radius-server host 172.0.0.30 key *******
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 transport input all
!
sntp broadcast client
end

3
  • Is the connection to the AP a L3 subnet, or are you trunking both VLANs (100 and 200) to the AP?
    – Ron Trunk
    Nov 11, 2014 at 13:12
  • Its a layer 3 subnet connection - no trunking on the APs
    – Maede
    Nov 11, 2014 at 14:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 1:26

2 Answers 2

2

One way to solve this problem is to change the AP connection to a layer 2 trunk with both VLANs on the trunk. You can have two different SSIDs (one for users, one for guests) and each SSID is associated with a VLAN. When a client connects to the Guest SSID, her data goes on VL 200; a regular user's data goes on VL 100.

You will need separate DHCP scopes for each VLAN, either on the AP or a central DHCP server.

6
  • My idea was to publish only 1 SSID to all users and put them into the correct VLAN by authenticate them over the RADIUS server. I actually have a central DHCP server which provides a scope per VLAN.
    – Maede
    Nov 11, 2014 at 14:44
  • The AP is not a router, so you will need to trunk both VLANs to it. How do you plan to distinguish between users and guests?
    – Ron Trunk
    Nov 11, 2014 at 14:55
  • All users must authenticate them over the RADIUS server, if there is a valid AD account, they get the VLAN100 access. There is also a guest AD account for e.g. visitors with only access to the VLAN200. The NPS role add the "Tunnel-Medium-Type, Tunnel-Pvt-Group-ID and Tunnel-Type" attributes to the RADIUS clients to tag them with the cortect VLAN id.
    – Maede
    Nov 11, 2014 at 15:24
  • That's OK. So you pass VLAN id of 200 to guests, but you need to trunk both VLANs to the AP.
    – Ron Trunk
    Nov 11, 2014 at 15:58
  • Why I need to trunk them? I configured the Dot11Radio-Interface and also the GigabitEthernet-Interface for both VLANs and the AP is already connected to a tagged VLAN port on the switch...
    – Maede
    Nov 11, 2014 at 16:44
2

Normally you'd have two SSID's, one "company" SSID and one "guest" SSID that maps to their respective VLAN's. However, you could use something like NAC (Network Admission Control) and "trick" the RADIUS server to send an admission deny for clients authenticating with the guest credentials. Check out this doc from Cisco: NAC Support for MBSSID

2
  • The only difference to my current config is that I am using one SSID. If I would add a second SSID there is no change on the RADIUS server especially on NPS role required.
    – Maede
    Nov 12, 2014 at 9:45
  • You don't have to add a second SSID. The documentation just shows you how you would do it with multiple SSID's, but you can just as well use a single SSID. The point is, the client logs onto one SSID, that logon is rejected by NAC making the client stick in the "guest" VLAN.
    – RedShift
    Nov 12, 2014 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.