9

I want to test 802.1x on a test SSID. Wasn't sure if making a test SSID associated to a VLAN that already has another SSID associated with it would cause a problem with the customer facing SSID.

Ex. SSID 1 = VLAN 1 SSID 2 = VLAN 1 - has 802.1x specific configurations

| improve this question | |
  • 2
    what vendors and firmware versions are you trying it on? what are you using for auth server? – Mike Pennington Jun 24 '13 at 23:19
  • Vendors - Cisco 1142 AP's (autonomous) - for authentication - plan to use a Windows DC, running IAS! – A L Jun 24 '13 at 23:30
  • What value does the 802.1X test have with the same SSID? – generalnetworkerror Jun 25 '13 at 0:41
9

Cisco won't allow more than one SSID per VLAN per Interface using Autonomous APs. Can't answer for WLCs, but I would assume the same thing.

If you have a single radio AP, I recommend having a test VLAN to go with the test SSID and then have your router route between the VLANs.

AP Message When Attempting:

#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
(config)#dot11 ssid Example
(config-ssid)#vlan 21
Warning: Vlan 21 already mapped to SSID Guest. SSIDs with same vlan association cannot be attached to the same interface.

(config-ssid)#

Originally I took this as one to one but when I tried it on a dual radio AP I was able to replace the Guest SSID on the 5Ghz radio:

(config-ssid)#int D1
(config-if)#no ssid Guest
(config-if)#ssid Example
(config-if)#exit
(config)#exit

#sh dot11 bssid
Interface      BSSID         Guest  SSID
Dot11Radio0   0026.0bXX.XXXX  Yes  Guest
Dot11Radio1   0007.7dXX.XXXX  No   Example

#

EDIT: Corrected myself, it does work on a dual radio AP, but not single radio

| improve this answer | |
  • 3
    FYI on a WLC you can assign multiple SSIDs to a single VLAN. However, on a WLC - you're not really assigning the SSID to VLAN, but instead assigning it to an interface group which then, assigns itself to the appropriate vlan via tagging or native....you can also specify backup ports too! – knotseh Jun 25 '13 at 0:39
  • Thanks for the info hestonk! I haven't had the opportunity to use a WLC yet. Hopefully soon! The experience would be a nice addition. – some_guy_long_gone Jun 25 '13 at 12:49
  • so I've actually just come across this exact issue on a dual-band AP - You can have 2 different SSIDs running on the same vlan HOWEVER that is because they're running on different radios. I still have the same issue as the OP where you can't run different SSIDs on the same VLANs....annoying! – knotseh Jun 27 '13 at 23:36
3

Not sure if it's a best practice, but we have many SSID's on a single VLAN... Some use the same DHCP pool, others use a separate one. (We use multiple SSIDs to implement policy differences and auth settings.) This is on a WLC 5500-series.

| improve this answer | |
1

My experience has been that more than one SSID on a VLAN, each with a different type of encryption, is not possible on an autonomous AP (12.4(x)). We do it all the time on WLC-controlled lightweight APs. For instance, one SSID with WPA2-Enterprise with 802.1x PEAP-MSCHAPv2 and AES encryption, a second SSID with WPA pre-shared key with TKIP encryption, and a third SSID with WEP-128.

Now, you can question the propriety of doing this on one VLAN, but it works. One justification is that you must use some old devices along with modern devices. Configure the old devices with the older auth and encryption methods and config the modern devices with the newest methods. Once you get rid of the older devices you can delete the old SSIDs and your modern devices don't have to change. Better than using WEP-128 as the lowest common denominator for everyone right from the start.

| improve this answer | |
  • On an autonomous AP, even returning a RADIUS assigned VLAN ID that already belongs to a different SSID will cause the connection to fail. – Monstieur Nov 6 '17 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.