Virtual LANs

A virtual LAN (VLAN) is a logical network segmented by function or application, without a regard to physical location.

A VLAN breaks a single network into multiple broadcast domains, thus effectively creating multiple separate networks out of the same network. This segmentation adds security and reduces the number of broadcast traffic received on individual devices. SmartZone controllers provide you with the following services for VLAN management:

Dynamic VLAN can be used to automatically and dynamically assign wireless clients of the same WLAN to different VLANs, based on RADIUS attributes. After the wireless client associates with a WLAN on which Dynamic VLAN is enabled, the AP requires the user to authenticate the RADIUS server. If the client is authenticated, the RADIUS server will include the VLAN attributes for the AP to locate the client in the specific VLAN.

Note: Dynamic VLAN supports a maximum of 128 VLANs per AP.

For Dynamic VLAN to work, you must configure the following RADIUS attributes for each user:

  • Tunnel-Type: Set this attribute to “VLAN”.
  • Tunnel-Medium-Type: Set this attribute to “IEEE-802”
  • Tunnel-Private-Group-ID: Set this attribute to the VLAN ID to which you want to segment this use.

Depending on your RADIUS setup, you may also need to include the username or the MAC address of the wireless device that the user will be using to associate with the AP. The following table lists the RADIUS user attributes related to dynamic VLAN.

RADIUS user attributes related to dynamic VLAN

Attribute Type ID Expected Value (Numerical)
Tunnel-Type 64 VLAN (13)
Tunnel-Medium-Type 65 802 (6)
Tunnel-Private-Group-Id 81 VLAN ID

Enable Dynamic VLAN in the Advanced Options of the WLAN configuration when the authentication method is set to 802.1X, MAC address or 802.1X + MAC address, thus overriding with the RADIUS setting the Access VLAN configured to the WLAN.

VLAN Pooling

When Wi-Fi is deployed in a high-density environment such as a stadium or a university campus, the number of IP addresses required for client devices can easily run into the thousands. Allocating thousands of clients into a single, large subnet or VLAN can result in degraded performance due to factors such as broadcast and multicast traffic. VLAN pooling is adopted to address this problem. VLAN pooling allows administrators to deploy a pool of multiple VLANs to which clients are assigned, thereby automatically segmenting large groups of clients into multiple smaller subgroups, even when connected to the same SSID. As the client device joins the WLAN, the VLAN is assigned to one of the VLANs in the pool based on a hash of the client’s MAC address.

To enable VLAN pooling, create a VLAN Pooling profile and assign the profile in the Advanced Options of the WLAN configuration.

Note: The 802.11ac wave-2 AP models support a maximum of 64 VLANs. Other AP models support up to 32 VLANs.

To create VLAN a Pooling Profile, complete the following actions:

  1. In the main menu, navigate to Security > Access Control > VLAN > VLAN Pooling. This displays VLAN Pooling screen.
  2. Select the zone and click Create. This displays the Create VLAN Pooling Profile page.
  3. Enter the following details:
    1. Name: Type a name to identify the VLAN profile.
    2. Description: Type a short description for the VLAN profile.
    3. VLANs: Type the VLAN IDs to be assigned to this pool. VLAN IDs can be separated by hyphens, commas, or a combination (for example, 7-10,13,17,20-28).
    4. Click OK.

    You have created the VLAN Pooling profile.

Note: Each VLAN pool can contain up to 64 VLANs, and a maximum of 64 VLAN pools can be created. Each WLAN can be configured with a single VLAN pool. For 802.11ac Wave-1 APs, the dynamic VLAN number is 32. For 802.11ac Wave-2 APs and 802.11ax APs, dynamic VLAN number is 64.

VLAN Precedence

You can assign VLANs to wireless clients by various methods, and there is an order of precedence by which APs assign the VLANs. The assignment is commonly from lowest to highest precedence. However, you can create a Precedence Profile where you can change the order of the VLAN precedencies.

To create a Precedence Profile, complete the following actions:

Note: The Precedence Profile includes VLAN precedence and Rate Limiting precedence configurations.
  1. In the main menu, navigate to Security > Access Control > VLAN > VLAN Precedence. This displays the VLAN Precedence page.
  2. Click Create. This displays Create VLAN Precedence page.
  3. Enter the following details:
    1. Name: Type a name to identify the VLAN Precedence profile.
    2. Description: Type a short description for the VLAN Predence profile.
    3. VLAN Precedence: Use the Up and Down options to set the VLAN priority. Choose the precedence for VLANs assigned by AAA (RADIUS dynamic VLAN), Device (device policies), or WLAN (WLAN configured access VLAN).: Type the VLAN IDs to be assigned to this pool. VLAN IDs can be separated by hyphens, commas, or a combination (for example, 7-10,13,17,20-28).
    4. Click OK.

    You have created a VLAN Precedence profile.

Assign the Precedence Profile to a WLAN in the Advanced Options of the WLAN configuration.

VLAN Name

Create VLAN name can be 32 characters in length. The default VLAN (VLAN1) uses default values, and you cannot create, modify, delete, or suspend activities on the default VLAN.

To create VLAN Name Profile, perform the following:

  1. In the main menu, navigate to Security > Access Control > VLAN > VLAN Name. This displays the VLAN Name page.
  2. Select a zone from the hierarchy and click Create. This displays the Create VLAN Name Profile page.
  3. Enter the following details:
    1. Name: Type a name to identify the VLAN name profile.
    2. Description: Type a short description for the VLAN name profile.
    3. VLAN Mapping: Enter VLAN Name and VLAN ID and click Add.
    4. Click OK.

    You have created a VLAN Name Profile.

Parent topic: Wireless Services