1

I'm deploying Wireless Access Points with two SSIDs: employee (VLAN 45) and guests (VLAN 46). I'm confused how I should configure the Ethernet port on the APs and switch.

My preference would be to configure the switch port as an access port, so that the WiFi end points are locked down. That's what I'd do if there was no guest WLAN. However, I don't think that will work: Since there will be two VLANs, I believe I need to configure the switch port as trunked. My concern, though, is that making it a trunked switch port opens it up to all VLANs. Even if I restrict the VLANs to 45 and 46 on the switch port, it still means that anyone who, for example, disconnects the AP and plugs in has access to a trunked port.

How can I lock down the Wireless AP switch ports while still supporting two SSIDs and VLANs?

Improve this question
4
  • What is the switch model? You can normally restrict a trunk to only allow specific VLANs.
    – Ron Maupin ♦
    Commented Jul 10, 2018 at 4:32
  • Switch is Cisco SF350.
    – SRobertJames
    Commented Jul 10, 2018 at 5:39
  • More important than the switch model is the AP model and design philosophy. If the APs are tunneling traffic back to a controller, then you would be configuring access ports. If the APs are bridging the traffic onto the local network, then you will need trunk/tagged ports. From there, security features that are supported by the switch and AP may be able to provide additional security (port-security, 802.1X, etc).
    – YLearn
    Commented Jul 10, 2018 at 5:44
  • Planned AP is WAP150 -- they go straight to the local network
    – SRobertJames
    Commented Jul 10, 2018 at 7:49

1 Answer 1

Reset to default
1

Supporting multiple VLANs on a switch interface means you will have a trunk with tags to separate frames for each VLAN on the trunk, except the native VLAN (if any). On your Cisco 350 switch, you can restrict which VLANs are allowed on a trunk:

switchport trunk allowed vlan {all | none | add vlan-list | remove vlan-list | except vlan-list}

For example, assume the user VLAN is 45, the guest VLAN is 46, and the trunk interface to the WAP is port 48:

interface GigabitEthernet48
 switchport mode trunk
 switchport trunk allowed vlan 45,46
!

Most end-devices do not understand VLAN tags, and they will drop tagged frames as giants. If you are concerned about someone making unauthorized connections to your switch interfaces, then you need to use 802.1X, but that will require some work to set up the infrastructure. That switch model supports 802.1X

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.