Vlan Configuration Example - Cisco ISR Configuration Manual

Chapter 8 Configuring VLANs

VLAN Configuration Example

This example shows how to use VLANs to manage wireless devices on a college campus. In this
example, three levels of access are available through VLANs configured on the wired network:
•
•
•
In this scenario, a minimum of three VLAN connections are required, one for each level of access.
Because the access point can handle up to 16 SSIDs, you can use the basic design shown in
Table 8-1
Level of Access
Management
Faculty
Student
Managers configure their wireless client adapters to use SSID boss, faculty members configure their
clients to use SSID teach, and students configure their wireless client adapters to use SSID learn. When
these clients associate to the access point, they automatically belong to the correct VLAN.
You would complete these steps to support the VLANs in this example:
1.
2.
3.
4.
5.
6.
OL-6415-04
Management access—Highest level of access; users can access all internal drives and files,
departmental databases, top-level financial information, and other sensitive information.
Management users are required to authenticate using Cisco LEAP.
Faculty access—Medium level of access; users can access school's Intranet and Internet, access
internal files, access student databases, and view internal information such as human resources,
payroll, and other faculty-related material. Faculty users are required to authenticate using Cisco
LEAP.
Student access—Lowest level of access; users can access school's Intranet and the Internet, obtain
class schedules, view grades, make appointments, and perform other student-related activities.
Students are allowed to join the network using static WEP.
Access Level SSID and VLAN Assignment
SSID
boss
teach
learn
Configure or confirm the configuration of these VLANs on one of the switches on your LAN.
On the access point, assign an SSID to each VLAN.
Assign authentication types to each SSID.
Configure VLAN 1, the Management VLAN, on both the fastEthernet and dot11radio interfaces on
the access point. You should make this VLAN the native VLAN.
Configure VLANs 2 and 3 on both the fastEthernet and dot11radio interfaces on the access point.
Configure the client devices.
VLAN ID
1
2
3
Cisco Wireless ISR and HWIC Access Point Configuration Guide
VLAN Configuration Example
Table 8-1.
8-9