1

Network topology:

enter image description here

I saw a tutorial video which teaches me to build a wireless network like the image above.

And he said he used two VLANs:

  1. One is for APs and controller and management.
  2. The other is for clients.

I can understand that APs can talk to controller since they're in the same VLAN.

But here comes the problem. How can he set the two clients to another VLAN while they communicate via APs?

If the two clients have no VLAN since they're not directly connected to the switch, are they in the same VLAN as the AP they connect to?

If so, will there be some security issue that hosts and controller are in the same VLAN?

Improve this question
  • FYI, you should not cross-post questions to multiple SE sites. You should pick one and delete the others. – Ron Maupin♦ Jul 10 '16 at 1:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 14 '17 at 21:29
2

Typically, with a wireless controller, your WAPs will be in a VLAN specifically to manage the WAPs, and it will not be the same as a user data VLAN. The users on the WAPs will get assigned a user data VLAN by the controller, and the WAPs will tunnel the user data via a CAPWAP tunnel to the controller, which will decapsulate the data and place it on the correct data VLAN.

A controller could have multiple user data VLANs, each with its own SSID, with which the WAPs work. Each WAP could advertise all or some of the SSIDs, depending on how the controller configures each WAP. The WAPs get their configurations from the controller; they are not configured individually.

Improve this answer
  • Great answer. It would also be worth mentioning though that you can use FlexConnect (cisco.com/c/en/us/td/docs/wireless/controller/8-0/…) which does not require traffic to be sent from remote APs to the central controller. – OzNetNerd Jul 11 '16 at 1:15
  • @OzNetNerd, I thought about that, but it is really a kludge, and you still want to put the data on a different VLAN. That's why I said "typically." Roaming can be a problem with FlexConnect, but tunneling the data back to the controller solves that problem. There are also the new switches that have a controller which works with the controller that will provide the equivalent of FlexConnect without the roaming problem, but I really didn't want to confuse the OP. – Ron Maupin♦ Jul 11 '16 at 1:22
  • I would also like to mention that not every controller will tunnel traffic back to the controller. Alot of controllers will allow you to bridge at the access point, which means that once it has connected to the AP, it will use the specified VLAN to continue on it's journey on the network without having to go to the controller. So if you wanted to get out of the Internet, it will simply go to it's default gateway rather than the controller which will route the traffic to the gateway. This eliminates the controller as a potential bottleneck. – SleepyMan Jul 11 '16 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.