Wireless Access

Hi there, guys and gals!

I have a customer site with a somewhat unusual requirement.

School network with four distinct groups of users and a smoothwall content filter on transparent proxy.

The smoothwall is going to apply different policies based on IP address and to this end the customer wants 4 ssid's (no RADIUS), and each ssid to collect an IP from a different DHCP server... completely flat CAT B network with no VLANs...

Is this possible? I cant see how it can be done without introducing a seperate VLAN for each group of users, and this is outside the scope of works at the moment due to switched infrastructure being managed by sperate entity and subject to costly change protocol.

Is it possible to set a series of different Vlans and therefore IP addresses and DHCP scopes within the controller that would be transparent to the rest of the network? even if it is possible would this serve the purpose?

Hope you genii can help!

yes.

You can create the VLANs internally on the controller, but you would need to add routes on your internal network to point to the controller's management ip address to reach those subnets.  In addition, you would need to stay within the 512 host limit of DHCP on the controller, or use an external DHCP server to supply DHCP for those subnets.  Create your Virtual APs and assign them to VLANs in the controller and you are good to go.

Hi, and thanks for the reply!

I think that might not work for the infrastructure I have to deal with: the ranges are all parts of the same CAT B network...

If I were to set VLAN DHCPs as follows:

user group 1: 192.168.10.x\16

user group 2: 192.168.20.x\16

user group 3: 192.168.30.x\16

user group 4: 192.168.40.x\16

wouldnt the controller throw one as they are all in the same network?

You need to adjust the mask to a /24 for the controller to see them as different networks.

Thanks for the reply,

will have a look on site and a chin wag with the customer to see what we can do and update you!

thanks for your help!

Just a question

Are they using secondary addressses or something like that as the default gateways of all those networks?

if this is true then you should recommend them to use vlans or something that divide the broadcast domain and also try not putting more than 200 users per broadcast domain...

If its the case they are using secundary addreses then it means that they are all in the same broadcast domain which is bad...

Hi guys,

thanks for the help and advice...

In the end we plugged 3 VLANs in to the client's smoothwall and let that handle the DHCP on a per port basis, one cable per SSID with VLAN 1 just pumped out into the switched network. This overcame the 256 limit and the client seems happy.