Port/VLAN best Practice

[matthew_kopishk]

Hi Everyone,

I have a SZ-100 setup with a single port group setup.  We have 46 APs currently and are expecting to add 30 more at another location on campus.

Currently, the primary wireless LAN lives on the same VLAN as the APs and the SZ-100 (the vendor that installed the equipment set it up this way).  I would like to break it up so the APs and the SZ-100 live on our "management vlan" and then have the primary WLAN live on its own.

I know out of the box we could have gone with a two-port group, is it worth going through the hassle of resetting everything and going this route, or stick with the current single port group and just adjust the SZ-100 & APs IP addresses and vlans accordingly?

I'm leaning towards the latter but I figured it was worth asking before I proceeded.

Thanks,

Matt

[matthew_kopishk]

Not really the way things are currently setup.  Is there a reason other than getting the APs pointed in the right place to not change the SZ-100's IP?

[albert_pierson]

It is best NOT to change the management vlan (enable tagging) for the AP's.

This is done under Zone configuration or AP group configuration under advanced settings - AP management VLAN - default is "keep AP settings"

If you tag AP management you will need to always do a 2 step process when adding AP's or after factory defaulting AP's.  By default AP's send management traffic untagged.  If you enable tagging for AP management when a factory defaulted AP is added you would first have to connect it to an untagged port and then as soon as it gets it's configuration from the SZ it will loose contact until the AP is physically moved or the switch port is re-configured with the correct tagged VLAN.  This is messy unless really needed.  It is best to always have AP's connected to ports where AP to SZ management VLAN is native or untagged.

It is much easier and better practice to tag the WLAN/SSID and put client traffic into a different VLAN.

If you use the native/untagged VLAN at the AP port and SZ port it really does not matter what VLAN ID is since access/native ports ignore and stip vlan's by definition.  They can be any VLAN ID in the network, but it is always best to have AP's and SZ management untagged at the ports.

Simply tag the WLAN/SSID (called access VLAN in WLAN as it acts like an access port at the wireless client end) and create the VLAN infrastructure to carry this traffic outside of the AP to SZ management and avoid multicast and broadcast storm issues.  You can easily separate different WLAN's into different VLAN's to isolate traffic ie Guest vs internal clients and determine if they can intercommunicate in the VLAN router.

[matthew_kopishk]

I guess I didn't make myself clear.  I think were both n the same page, the management VLAN will remain untagged/VLAN 1 through the on the switch the untagged/tagged VLANs will change.  This will mean there will be a ip/netmask change on that VLAN but it will remain VLAN 1 as far as the SZ-100 is concerned.

The WLAN will change to the tagged VLAN ID.

Sorry if I confused things and thank you for your help.

[eizens_putnins]

Basically what you want is to move SZ and APs into different VLAN (which is not VLAN 1 on switch), which  requeres the change of IP addressing.

As far as VLAN is untagged on port, the connected device (SZ or AP) has no idea about what is this VLAN ID in the switch, VLAN ID is a designation local to the switch, so the only thing visible for devices will be different IP addresses.

It is easy to be done, just needs some planning -- as your APs will lose connection to SZ, when it IP will be changed (I suppose that you use DHCP for AP addressing, so moving them into new segment will change they addresses automatically). You can use DHCP or DNS options to supply new SZ IP to APs, and nevertheless, this may be disruptive, and you can end up manually configuring part or all APs using SSH (which isn't that difficult, just take care that you know username/password for AP SSH connection - it is set in Zone configuration.

Anyway, I would say that it is only a half of the good setup -- I would recommend having APs on different VLAN from SZ. Of cause, having firewall or at least NAT router between AP VLAN and SZ will make setup much more secure, but if all this is localized in a few switches in your office, you don't really need that. If it is a big camus or public venue, than firewall is highly recommended.

User traffic must use different VLANs (tagged on AP, and not needed at all on ports, where SZ is connected), with separate DHCP/DNS setup.

What would be a very bad idea, to use tagged management VLAN on APs -- it makes AP preparation for deployment cumbersome and makes setup prone to problems during AP upgrades and reboots. With untagged management VLAN on AP you usually can connect to it even if the configuration is broken, you can factory reset it remotely and reconfigure. If you have full access to switch, you can do it  with tagged management VLAN also, but it takes much more effort, so don't use tagged management VLAN if you can avoid it...

[matthew_kopishk]

Thanks for the input.  I really feel I haven't made myself clear, I do understand how VLANs work, that's not the issue.

Really what I was trying to figure out is if I needed to move to a two port group (which I clearly don't).

I'll get things swapped over.

Thanks again.