Table of Contents
Advertisement
Appendix A:
To configure a termination VLAN properly, do
protected side with a VLAN ID that corresponds to a VLAN interface on the managed
side.
Initiation/Switched VLANs
With initiation or switched VLANs on the BSC, VLAN tags are added to packets exiting
the BSC on the protected side based on the user's Role.
Knowing that each user authenticates into a Role on the BSC, you may configure Roles on
the BSC to automatically tag packets exiting the BSC with a particular VLAN ID. This
capability enables you to route traffic from particular users to particular VLANs on the
protected side.
The following figure illustrates use of an Initiation VLAN on the Bluesocket BSC.
Initiation and switched VLAN are identical except that for switched VLANs there is an
input VLAN on the managed side. This VLAN is not the same ID as the one going out the
protected side. In the case of the same VLAN ID coming in and going out, no role-based
tagging is required. See "Pass-Through VLANs" on page A-3.
Note: Since Roles on the BSC are made up of a set of policies governing network usage
(including network services), packets entering the BSC from a particular user may leave
with different VLAN IDs (VLAN tags) based on the network service the user is using on the
managed side at that point in time.
See "Creating a VLAN on the Protected Side (Optional)" on page 4-5 for information
about creating VLANs on the protected interface. See "Defining a Role" on page 8-4 for
information about adding VLAN tagging to Roles.
In summary, create:
•
VLAN interfaces on both the managed and protected sides with the same VLAN ID to
cause the VLAN traffic to pass-through the BSC
•
a VLAN on the managed side with no corresponding VLAN on the protected side to
terminate VLAN traffic on the BSC
•
VLAN interfaces on the protected side and configure VLAN tagging within a Role to
cause user traffic to initiate the VLANs from the BSC
A-4
Untagged VLAN
MAC Frame
7x
8x
9x
10x
11x
12x
7x
8x
9x
10x
11x
12x
C
7 8 910 11 12
A
1 2 3 4 5 6
1x
2x
3x
A
4x
5x
6x
1x
2x
3x
B
4x
5x
6x
Switch
Access
Point
Untagged VLAN
Managed Side
Figure A-4: An Initiation VLAN
not
configure a VLAN interface on the
BlueSecure
Controller
VLAN 2
User
Power
Reset
Role
WG-2100 Wireless Gateway
VLAN 3
Tag
MAC Frame
Protected Side
Protected
Network
MAC Frame
Tagged VLAN
VLAN ID N
Advertisement
Table of Contents
