I am trying to setup a separate private network for a rented office in our building. I think i have succeeded in setting up two private LAN networks using port based VLAN's ( and

As the access points are required to be setup using management software on a computer I want to manage each access point from the control station without being able to communicate with the network, is this possible? If not, what would be a way to have to private LAN's that cannot communicate with each other but would allow me to manage all access points.

enter image description here Updated network: enter image description here

1 Answer 1


One of your WAPs is in the network on an unmanaged switch. That presents a problem if the controller is not allowed to access that network. What you really want to do is set up each WAP with a trunk. You want to trunk a management VLAN to the WAPs, along with the user VLANs for the WAPs. Unfortunately, you can't trunk with an unmanaged switch.

The ideal way is to create a management VLAN, and have the WAPs and the controller all connected to that VLAN. You also trunk whichever user VLANs you want the WAPs to advertise through SSIDs. You will need to replace the unmanaged switch with one that can do VLANs. This will also make the management of the WAPs more secure, and you can use the management VLAN to manage the switches, too.

  • You need to have managed switches all around, and the switches need to trunk the user and management VLANs. The replacement for the current unmanaged switch would have both the management and VLANs, and the other switches would have both the management and the VLANs. You could use something like the network for the management VLAN.
    – Ron Maupin
    Commented Aug 19, 2016 at 12:48
  • So if i understand correctly it will end up looking something like the added picture. It has been almost 10 years ago since I last did anything like this, so I'm relearning almost everything here. I appreciate your help and patience!
    – Sisco
    Commented Aug 19, 2016 at 14:00
  • On the switch trunks, especially to the WAPs, you want the management VLAN to be untagged, and the user VLAN as tagged. The WAPs will use the untagged VLAN as the management VLAN. You can actually send both user VLANs on each WAP, by using separate SSIDs, so you could trunk both user VLANs to all the WAPs.
    – Ron Maupin
    Commented Aug 19, 2016 at 14:08
  • So on the trunk from router to swith i should have untagged 100 and Tagged 10/20 and the same from switch to switch and switch to WAP?
    – Sisco
    Commented Aug 23, 2016 at 7:32
  • Yes. The untagged VLAN will be the management VLAN for the WAPs, and you can address your switches from that too. Then you can restrict the users from that VLAN, and you gain some security.
    – Ron Maupin
    Commented Aug 23, 2016 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.