Centrally-Managed, Dual-Network 802.11 APs? [closed]

Question

My company has multiple offices connected over a WAN. We would like to deploy a centrally-managed WiFi configuration to all offices, with the following characteristics:

• Two SSIDs (simultaneously available on each AP): One public and routed only to the Internet, and one private and connected to our LAN.
• Central management of AP configurations across the WAN. This could be a canned tool, or scripted bulk upload of text-based config files.
• RADIUS authentication for the private network.
• Direct routing from each AP to a local address or to the appropriate router for the next hop.
• APs that can use Power over Ethernet (though not all locations have PoE switches).
• Reasonable price, possibly in exchange for some DIY effort on the config side.

One of our offices currently uses a commercial product which satisfies most of these criteria, but it needs a central controller in each office. Traffic is tunneled from the APs back to the controller, and from there to the destination. If we were to deploy APs across the WAN, all traffic would be tunneled from site B back to the controller in site A, then back to a "local" destination in site B. Putting controllers in each office, though, gets expensive very quickly.

So, I'm looking for leads on individual APs or complete solutions that will satisfy these criteria at a reasonable price.

Thank you in advance.

Answer 1

This gets an order of magnitude simpler if you do one SSID/AP instead of requiring two SSIDs from one AP. It will change the level of gear you need (to a much cheaper grade). Given that caveat, you could likely do the whole thing with openWRT on the software side and any number of APs on the hardware side. Then management would be via ssh (highly scriptable) and backups would be a matter of downloading a (4-8MB) copy of the flash every so often.

Answer 2

I have successfully deployed multiple HP Accesspoint with your requirement. The Product I used was the AP420. I manage them via the HP Procurve Manager. They Provide one visible WLAN and I think up to eight hidden SSIDs with different settings for encryption and authentication. They can each come out via different vlans.

Answer 3

I believe the wireless network solutions from Trapeze will meet your needs.

Answer 4

Do you want APs that can use PoE and a regular power brick source or just PoE? I think they might well be in different price brackets. If it's the latter, you'll have to factor in power injectors for the locations without PoE switches.

Similarly, as pjz pointed out, doing >1 SSID on the same radio might well increase the price dramatically.

Answer 5

These are the brands you should be looking to if you want an entreprise-class solution (Gartner is always a good indication for the biggest players):

• Cisco (bought Airespace 3 years ago)
• Aruba
• Trapeze

(Meru, Motorola, Xirrux, ...)

We always deploy Trapeze with good experience.
BTW: 3com, Nortel sell OEM-equipment from Trapeze as enterprise Wireless solution.

With Trapeze you don't have to deploy a controller on each site. One central controller can manage remote APs (if you have VPN or leased line!).
With the use of VLAN-tagging on the APs ("=local switching") not all wireless traffic needs to pass the central controller. However: this local switching feature cannot be combined with the captive web-portal. This would mean that your requirement of direct routing would mean no authentication at all on the public internet.

The centralized management is really worth the money in my opinion, and Trapeze is really good value for money.

Thomas

Answer 6

Thanks to all who have answered.

Upon digging deeper into the product we already have, it appears that we can bridge traffic directly from the AP onto the LAN, with optional VLAN tagging per distinct SSID. This is consistent with Paul's answer.

Since it does indeed perform as we need (in theory), I'll mention our current solution: We're using Siemens' HiPath Wireless solution. They struck the right price/performance balance when evaluated for a single office several years ago.