5

I have a question regarding best practice. I have a case where i need multiple VLAN's in wireless networks. What is more performant?

Having multiple SSID and each of them have a VLAN (this also mean that they will be on the same chanell on that AP. Having one SSID for all asign VLAN's based on radius MAC auth rules

I'm also thinking if there is a way to encrypt open comunication...

Thank you

2
  • 1
    Wi-Fi doesn't actually implement VLANs. Multiple wired VLANs translate to multiple SSIDs. Technically, Wi-Fi could implement VLANs, but it really hasn't been done. There is a proposed standard to implement Wi-Fi VLANs for wireless trunks, but I don't think it has any actual implementations.
    – Ron Maupin
    Oct 4, 2017 at 4:50
  • 1
    The implementation is already done, I assign VLAN by Radius server and it works. I'm just asking what is the best practice Oct 4, 2017 at 6:28

2 Answers 2

3

Ideally you want only one SSID for each 802.11 security method you wish to employ (802.1X, PSK, and/or Open). To accommodate multiple VLANs, you would typically return a VLAN assignment from a RADIUS server or utilize a vendor's proprietary solution. The absolute maximum number of SSIDs you want to consider having should be no more than 4-6, but it is better if you use a maximum of 2-3.

Cisco's best practices document recommends 1-3 SSIDs:

It is recommended to have one to three SSIDs for an enterprise, and one SSID for high-density designs.

Aruba's best practices give an even lower target at 2:

Use as few SSIDs as possible. Generally, one WPA2 Enterprise SSID and one Open SSID are more than enough.

Why these numbers? There are two primary reasons. First, most wireless industry experts/vendors would agree that using separate SSIDs (with the same 802.11 security) simply to provide differing levels of access/privilege is poor design and security.

Ideally you would want to enforce any sort of access restriction or security policy based on the role of the user and/or device in the organization. Aruba probably gives one of the best official statements to this effect in this document:

[...] SSIDs are used for user classification and access rights policing. Thus users are assigned access rights not by their identities but by their SSID association which could give a malicious spoofer privileged access into the network. The solution requires Employee A in the sales department to associate with the “Sales” SSID for the right network access privileges. Associating with the “Employee” SSID could result in Employee A gaining access to a privileged set of servers not accessible to the Sales user group. This is because the rights are assigned by the SSID and not Employee A’s identity or authentication profile.

It is also easier to implement, support, manage and enforce when all employees connect securely to one 802.1X SSID that assigns access/privileges based on their role. No time wasted in figuring out which network they should connect to (or even connect to for different functions). Less confusion for end users as well since they all connect to the same SSID.

The second reason for lowering the number of SSIDS is spectral efficiency, or in other words since 802.11 traffic is a shared medium you want to increase the amount of "airtime" available to actual data and reduce the amount of non-data traffic such as management frames.

The general rule of thumb is the more SSIDs your wireless network is broadcasting, the less efficient it will be (i.e. less capacity for actual data traffic). Each SSID requires that the AP generate and send a beacon every "period of time" (usually about every 100 milliseconds). These beacons (and other management frames such as probe requests and responses) will typically use a much lower data rate than would normally be used for data traffic and as such take up a disproportionate amount of airtime.

Most of the references citing statistics for multiple SSIDs that I am aware of are older documentation. The numbers may not be as exact due to changes in 802.11, but the principles still apply. Data rates have increased, but so has the size of the typical beacon frame. Anyhow, here are references from Arubu's Airheads Community and Revolution Wi-Fi that provide statistics showing the impact of multiple SSIDs.

4
  • I have 3 to 5 ssid's depeinding on the area, on same radio they are on same channel, I want to reach a maximum of 2 Oct 4, 2017 at 8:18
  • @GeorgeFarcas, 3-5 is manageable. 2 is just about ideal. You are on the right path.
    – YLearn
    Oct 4, 2017 at 16:19
  • What i don't like is that they are on the same channel (because it's only one bssid) Oct 5, 2017 at 7:42
  • @GeorgeFarcas, you are correct that every SSID/BSSID on a single radio will share the same channel. This is required for proper 802.11 operation as CSMA/CA is used to prevent collisions. If a radio changed channels to serve each SSID, it would be unavailable to the other channels for some period to participate in CSMA/CA and would miss clients that might be trying to talk. However, each SSID on a radio should have it's own BSSID and unless you are using some sort of single cell technology, each AP should have different BSSIDs than it's neighbors.
    – YLearn
    Oct 6, 2017 at 5:53
-2

The general rule is "one VLAN for each SSID", because otherwise you either don't need different VLANs or you don't need different SSIDs. SSIDs technically are the logical VLAN equivalent in the wireless world.

1
  • Do you have a reference to back up your assertion? Years of 802.11 deployments and I have never heard this one from vendors or industry experts.
    – YLearn
    Oct 18, 2017 at 23:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .