Broad question touching many vendors.


For a project of a client of mine (I'm giving the context to make things clearer, please don't reply with "get a professional", I'm not looking either for the HLD or the NRFU design here) we would like to give their tenants wireless access based on their own IP addressing plan.

My client would like to act as Wireless Service Provider within a campus in the same way nowadays ISPs provide WAN services to enterprises: that means that the AP/wireless physical infrastructure will be deployed by the SP, tenants will be given access and wireless client should get an IP based on the tenants' IP plan. Tenants' client will access their own wired LAN, not just the Internet

Have you seen this before? I bet no.

It is interesting? Yes, because we are trying to extend the SP WAN/MAN model to the wireless world.

Are we capable and do we have robust and solid tools/technologies in order to achieve the goal? No, but we are trying to get to it as close as possible with what we have.

What follows assumes that the wireless frame exit the wireless system at the controller level (hence control+data frames within CAPWAP). Also we wil have 3-4 SSID, a solution of one SSID per tenant is not feasible as APs cannot handle more than 16 SSIDs and I'm told that it's not recommended to reach that point if we don't want to have performances' issue.

After having contacted some vendors the answer is : no you cannot; you can provide such a service as long as you (the SP) supervision the tenants' subnets and make sure they do not overlap. Or, at least with some vendors (Huawei), the VLAN assigned must belong to different SSID, this makes sense because you may have the mark 'SSID' along with the wireless frame.


My understanding is that since wireless frames are decrypted by the controller (Split MAC) in Cisco (only?) terminology and then some checks are applied (like IP address theft heck) soon after, when the frame gets to the wireless controller, and hence not yet associated to the dynamic vlan, then clients (assigned in different VLANs afterwards) cannot share the same IP address. Over the years for performances' reasons issue vendors have kept the situation like that.

Another story is Local MAC (wireless frames turn into wired frames at AP's level) where some checks are relaxed and hence overlapping may be possible, but Split MAC is not the case here.


Fortinet states that with the integrated wireless controller in the Fortigate they can offer with no problem IP overlapping when speaking of dynamically assigned VLANs.

Does anyone know if that's true or could he/she mention other vendors who propose such interesting feature?

I apologize with serious sales people but as a technical engineer when speaking with them I have to double check every single statement they say.


  • 1
    Why would you trouble yourself with overlapping subnets? Can't you simply assign a range to each SSID/VLAN? You could likely use VDOMs on the Fortigate but what's the point? Also, have you made sure that your question is on-topic here as per the help center? 'Tenants' doesn't sound like that.
    – Zac67
    Nov 10, 2021 at 21:20
  • @Zac67: I'm not putting my self into trouble of overlapping subnets for fun, but as written if I want the tenants to keep their own IP plans then it's likely this will happen. The issue comes from the combination of 1) single SSID (you cannot have APs handle one SSID per tenant when you have 40 tenants) with 2) dynamically assigned VLANs (based on 802.1x) and 3) very likely overlapping tenants' IP plans Nov 10, 2021 at 23:03
  • 1
    You claim to be acting as the ISP, but the ISP assigns addressing for residential users. The residential users then have a router and assign their own network addressing inside their own network, but not the ISP addressing.
    – Ron Maupin
    Nov 10, 2021 at 23:09
  • @RonMaupin: thanks I specified that the SP model is for the WAN/MAN services rather than just Internet access, I hope is clearer now. Nov 10, 2021 at 23:58
  • 1
    If you have overlapping addresses on your network, you must separate them with NAT, but you will need to assign the "WAN" addresses for the NAT, the same way an ISP would.
    – Ron Maupin
    Nov 11, 2021 at 0:19


Browse other questions tagged or ask your own question.