Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

SSIDs WiSM modules and LAP 1010

Hello

I am trying to determine if it is possible to advertise 2 separate SSIDs from a single Aironet LAP 1010 device. It is controlled using a WiSM module in the core Cisco site Catalyst 6500 environments which are in the system domain.

One of these SSIDs is configured to talk to a system domain using various security authentication 802.1x etc. I would like to know if it is possible to configure a separate SSID which might be like DMZ with a totally separate set of IP address ranges and which is totally segregated from the system domain.

This second network might then connect into an external connection providing internet access?

i am sorry this is a little vague, but i do not have the detailed system configuration and design

thanks - i appreciate any expertise that you can provide in this matter - even if is only to say that the 1010 cannot advertise 2 SSIDs

dickon

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: SSIDs WiSM modules and LAP 1010

Let me clarify.

Let's say you have SSID Marketing for the marketing folks.

That SSID is linked on the Wism to interface MarketingInt on (for example) 192.168.1.x

You create then SSID Marketing for the Engineer dudes.

That SSID is linked on Wism to the Wism interface EngineerInt on : 192.168.2.x

2 separate subnets. The Wism has an ip address in both of those subnets thus.

The Wism cannot act as a gateway so you must have switch/router interfaces in those subnets to act as gateway.

How to prevent traffic to go from one SSID to the other ? Well simply by placing an Access list. On the switch you can prevent routing from one vlan to the other.

You can also put that directly on the Wism itself to prevent the Wism to immediately forward traffic destined to the other vlan to the switch.

3 REPLIES
Cisco Employee

Re: SSIDs WiSM modules and LAP 1010

Hi Dickon,

the 1010 can absolutely do that, and even more than 2 SSIDs.

You can simply configure on your Wism a second SSID and it will be serviced by your 1010s.

This second SSID you can assign it to a new interface on your Wism. So the wism can have interfaces in any subnet.

What you seem to mention is also another feature. If you have a second controller in a DMZ, then you can tunnel the traffic of the clients of one SSID from one WLC to the other WLC in the DMZ, simulating the fact that the clients of that SSID are directly in the DMZ. This is called mobility groups and guest anchor.

Hope it helps.

Regards,

Nicolas

--

If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

New Member

Re: SSIDs WiSM modules and LAP 1010

Nicolas

thanks for your prompt reply - i have a further question - it would be necessary to keep the traffic from the two SSIDs entirely separate - are there any technical measures which could be applied to prevent traffic 'jumping' from one SSID to another - i.e. the segregation i was referring to.

and i refer to technical measures in the 1010 and the WiSM

does this make sense?

thanks

dickon

Cisco Employee

Re: SSIDs WiSM modules and LAP 1010

Let me clarify.

Let's say you have SSID Marketing for the marketing folks.

That SSID is linked on the Wism to interface MarketingInt on (for example) 192.168.1.x

You create then SSID Marketing for the Engineer dudes.

That SSID is linked on Wism to the Wism interface EngineerInt on : 192.168.2.x

2 separate subnets. The Wism has an ip address in both of those subnets thus.

The Wism cannot act as a gateway so you must have switch/router interfaces in those subnets to act as gateway.

How to prevent traffic to go from one SSID to the other ? Well simply by placing an Access list. On the switch you can prevent routing from one vlan to the other.

You can also put that directly on the Wism itself to prevent the Wism to immediately forward traffic destined to the other vlan to the switch.

243
Views
0
Helpful
3
Replies
CreatePlease to create content