1

I am trying to setup a separate private network for a rented office in our building. I think i have succeeded in setting up two private LAN networks using port based VLAN's (192.168.10.0/24 and 192.168.20.0/24).

As the access points are required to be setup using management software on a computer I want to manage each access point from the control station without being able to communicate with the 192.168.20.0/24 network, is this possible? If not, what would be a way to have to private LAN's that cannot communicate with each other but would allow me to manage all access points.

enter image description here Updated network: enter image description here

| improve this question | |
0

One of your WAPs is in the 192.168.20.0/24 network on an unmanaged switch. That presents a problem if the controller is not allowed to access that network. What you really want to do is set up each WAP with a trunk. You want to trunk a management VLAN to the WAPs, along with the user VLANs for the WAPs. Unfortunately, you can't trunk with an unmanaged switch.

The ideal way is to create a management VLAN, and have the WAPs and the controller all connected to that VLAN. You also trunk whichever user VLANs you want the WAPs to advertise through SSIDs. You will need to replace the unmanaged switch with one that can do VLANs. This will also make the management of the WAPs more secure, and you can use the management VLAN to manage the switches, too.

| improve this answer | |
  • You need to have managed switches all around, and the switches need to trunk the user and management VLANs. The replacement for the current unmanaged switch would have both the management and 192.168.20.0/24 VLANs, and the other switches would have both the management and the 192.168.10.0/24 VLANs. You could use something like the 192.168.0.0/24 network for the management VLAN. – Ron Maupin♦ Aug 19 '16 at 12:48
  • So if i understand correctly it will end up looking something like the added picture. It has been almost 10 years ago since I last did anything like this, so I'm relearning almost everything here. I appreciate your help and patience! – Sisco Aug 19 '16 at 14:00
  • On the switch trunks, especially to the WAPs, you want the management VLAN to be untagged, and the user VLAN as tagged. The WAPs will use the untagged VLAN as the management VLAN. You can actually send both user VLANs on each WAP, by using separate SSIDs, so you could trunk both user VLANs to all the WAPs. – Ron Maupin♦ Aug 19 '16 at 14:08
  • So on the trunk from router to swith i should have untagged 100 and Tagged 10/20 and the same from switch to switch and switch to WAP? – Sisco Aug 23 '16 at 7:32
  • Yes. The untagged VLAN will be the management VLAN for the WAPs, and you can address your switches from that too. Then you can restrict the users from that VLAN, and you gain some security. – Ron Maupin♦ Aug 23 '16 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.