Broad question touching many vendors.
CONTEXT DESCRIPTION
For a project of a client of mine (I'm giving the context to make things clearer, please don't reply with "get a professional", I'm not looking either for the HLD or the NRFU design here) we would like to give their tenants wireless access based on their own IP addressing plan.
My client would like to act as Wireless Service Provider within a campus in the same way nowadays ISPs provide WAN services to enterprises: that means that the AP/wireless physical infrastructure will be deployed by the SP, tenants will be given access and wireless client should get an IP based on the tenants' IP plan. Tenants' client will access their own wired LAN, not just the Internet
Have you seen this before? I bet no.
It is interesting? Yes, because we are trying to extend the SP WAN/MAN model to the wireless world.
Are we capable and do we have robust and solid tools/technologies in order to achieve the goal? No, but we are trying to get to it as close as possible with what we have.
What follows assumes that the wireless frame exit the wireless system at the controller level (hence control+data frames within CAPWAP). Also we wil have 3-4 SSID, a solution of one SSID per tenant is not feasible as APs cannot handle more than 16 SSIDs and I'm told that it's not recommended to reach that point if we don't want to have performances' issue.
After having contacted some vendors the answer is : no you cannot; you can provide such a service as long as you (the SP) supervision the tenants' subnets and make sure they do not overlap. Or, at least with some vendors (Huawei), the VLAN assigned must belong to different SSID, this makes sense because you may have the mark 'SSID' along with the wireless frame.
WHAT I UNDERSTAND
My understanding is that since wireless frames are decrypted by the controller (Split MAC) in Cisco (only?) terminology and then some checks are applied (like IP address theft heck) soon after, when the frame gets to the wireless controller, and hence not yet associated to the dynamic vlan, then clients (assigned in different VLANs afterwards) cannot share the same IP address. Over the years for performances' reasons issue vendors have kept the situation like that.
Another story is Local MAC (wireless frames turn into wired frames at AP's level) where some checks are relaxed and hence overlapping may be possible, but Split MAC is not the case here.
QUESTION
Fortinet states that with the integrated wireless controller in the Fortigate they can offer with no problem IP overlapping when speaking of dynamically assigned VLANs.
Does anyone know if that's true or could he/she mention other vendors who propose such interesting feature?
I apologize with serious sales people but as a technical engineer when speaking with them I have to double check every single statement they say.
TIA
