Guest SSID on a dynamic VLAN (AP1230 with IAS) environment

alig.norbert · ‎05-25-2007

Hi all,

I got the following situation:

- AP 1230 PEAP-WEP-Auth.

- XP (SP2) Client

- IAS-RADIUS

The dynamic vlan assignement/authentication is working (with one SSID). When I configure a second (guest) SSID, there is no longer possible to get connected with one of the dynamic VLAN (authentication with the RADIUS is working, but no access to the VLAN).

I read an old posting that there is an issue with more than one SSID when using dynamic vlan.

(http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Wireless%20-%20Mobility&topic=Security%20and%20Network%20Management&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddded31)

The goal is to prvide an SSID for public/guest access and another SSID for dynamic assignement.

Any ideas?

Thank and greets,

norbert

fmeetz · ‎06-01-2007

Try upgarding the firmware verison to 12.3(2)JA2 for this multiple dynamic assignment to work.

ERIC ARMSTRONG · ‎09-06-2007

Are you using MBSSID to broadcast both networks? If so, there is an incompatibility with MBSSID and Dynamic VLAN assignment.

You need to broadcast only one of the SSIDs (via guest-mode). You can then use the information-element ssidl advertisement feature to inform clients of the additional SSIDs, if required:(http://www.cisco.com/en/US/docs/wireless/access_point/12.3_4_JA/command/reference/cr34main.html#wpmkr2681281)

alig.norbert · ‎09-12-2007

Hi all,

thanks for the reply and sorry for the delay.

Here the working config:

dot11 ssid guest

vlan 104

authentication open

guest-mode

mbssid guest-mode

!

dot11 ssid private

vlan 102

authentication open eap eap_methods

authentication network-eap eap_methods

interface Dot11Radio0

no ip address

no ip route-cache

!

encryption vlan 102 mode wep mandatory

!

ssid guest

!

ssid private

!

mbssid

....

...

station-role root

Greets,

Norbert