D-Link DWL-2600AP User Manual - Vlans
Configuring a Network to Use WPA2-Enterprise and Dynamic
VLANs
D-Link
Unified Wired and Wireless Access System
Oct. 2015
Page 706
D-Link UWS User Manual
Configuring a Network to Use WPA2-Enterprise and Dynamic
VLANs
This configuration example shows a company deploying a wireless network that uses WPA2-Enterprise
encryption and dynamic VLANs. To keep financial information separate from other corporate data, the
network administrator has configured a separate VLAN for Accounting Department employees. Because some
individuals may be granted access to the Accounting VLAN for a short period, the administrator decides to use
user-based granular control over VLAN assignments. The administrator controls access to the accounting VLAN
by using a RADIUS server and Dynamic VLAN assignment.
This example includes two wireless networks (VAPs):
• The Visitor network provides Internet access to guests. Guests who connect to the the Visitor network are
assigned to VLAN 10, which provides limited access to network resources.
• The Corporate network is for employees. An employee who connects to this network must be
authenticated by a network RADIUS server. By default, users on this network are assigned to VLAN 20.
However, when an Accounting Department user authenticates to the Corporate network, the user is
assigned to VLAN 30. The VLAN assignment in the RADIUS profile for an Accounting Department
employee takes precedence over the default VLAN of the VAP.
shows a summary of the VAP configuration in this example.
In
, when Client_1 initiates a connection to the Corporate network, the authentication information
is passed from the client to the AP, and from the AP to the switch. Then, the switch forwards the information
to the RADIUS server. If the authentication is successful, the RADIUS server response includes the VLAN
assignment information This example includes only one AP, but the configuration is easily scalable to multiple
APs.
Figure 438: WPA2-Enterprise and Dynamic VLAN Assignment
This example requires configuring settings on the RADIUS server and on the switch.
Table 388: VAP Summary
Network (SSID)
VLAN
Security
Redirect
Visitor
10
None
http://www.dlink.com/tw
Corporate
20
WPA Enterprise
None
Radius_1
10.27.65.120
Switch_1
10.27.65.79
Client_1
48:60:BC:76:79:3E
AP_1
10.27.65.178
1C:AF:F7:1F:27:40