Can't get WiFi dynamic VLAN assignment to work

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
12

Can't get WiFi dynamic VLAN assignment to work

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Can't get WiFi dynamic VLAN assignment to work
Can't get WiFi dynamic VLAN assignment to work
2023-01-03 22:30:51 - last edited 2023-01-25 07:00:57
Model: EAP670   EAP650  
Hardware Version: V1
Firmware Version: 1.0.3

I am trying to set up dynamic VLAN assignments on a single SSID but can't get anything to work.

MAC-based authentication is not suitable because I want to have many and arbitrary devices connect into a few sets of VLANs where I won't know the MAC addresses beforehand.

 

Setup

Device Hardware revision Firmware/Software version
Controller Docker 5.7.4
EAP650(EU) v1.0 1.0.3
EAP670(EU) v1.0 1.0.3

 

Everything is on the latest version as of now.

Both EAP devices behave exactly the same in all of my tests.

 

 

Attempt 1: RADIUS

I tried following https://www.tp-link.com/us/support/faq/3152/ and an awful lot of Googling. The RADIUS authentication is working and shows correctly in both the Omada & FreeRADIUS logs as accepting/rejecting valid/invalid logins.

To my untrained eye, the RADIUS handshake and response looks correct, and has the 3 attributes mentioned in that guide required to make the VLAN assignment work.

 

And the RADIUS profile has VLAN assignment enabled

I also have the VLANs defined for wired networks. I'm not sure if that matters or not but I've tried not having it defined, having it defined as an interface or a VLAN.

 

 

Attempt 2: PPSK

I had 2 issues with this while following https://www.tp-link.com/uk/support/faq/3386/.

  1. My devices don't seem to support it (yet). If I enable this on either the EAP650 or EAP670 then they stop broadcasting the SSID. I found a thread on Reddit where someone said this means it is not yet supported on my firmware but TP-Link are planning on bringing it to all EAP6xx models at some stage.
  2. It seems to not support 6 GHz WiFi. I only get the option for PPSK security if I untick 6 GHz. This is not a big problem since none of my current devices support 6 GHz but this may become a problem in the future if it is a limitation of 6 GHz in general when I want to add/upgrade hardware.

 

 

Attempt 3: Static VLAN

Just for the purpose of testing, I tried setting a static VLAN for the wireless network and this worked as expected. The AP itself uses untagged packets while client device traffic is tagged as VLAN 7.

This obviously doesn't meet my requirements though, so is not a viable solution unless I go the horrible route of lots of SSIDs.

 

Questions

  1. Do my EAP650 & EAP670 devices actually support dynamic VLAN assignment based on RADIUS? I note that the WebUI says only some devices support it and make sure the firmware is the latest, and I see some from Googling around that other features like PPSK &  MAC-based RADIUS are quite new and not supported by all devices but I can't find a list of what devices support what features and the WebUI provides no indication that some or all of my APs may not support the features enabled.
  2. Is there a way for me to further debug this myself in Omada? From the RADIUS side I can check the logs, test auth with radtest/radclient and can look at packet captures to ensure the RADIUS server is working as expected but all I can see in Omada are the Logs/Events that say "X was authenticated with the username Y to AP with SSID ...". Are there debug logs or anything else I can enable to get better diagnostics?
  3. Is there a way to force VLAN assignment? The WebUI option is to enable it but during my troubleshooting I found lots of people saying that it randomly fails either because of bugs with Omada firmware or misconfiguration or upgrades on the RADIUS server. I don't want devices accidentally or spuriously going untagged.
  1      
  1      
#1
Options
1 Accepted Solution
Re:Can't get WiFi dynamic VLAN assignment to work-Solution
2023-01-22 21:48:00 - last edited 2023-01-25 07:00:57

I've installed the 1.0.6 firmware on both EAP650 & EAP670 and can confirm that the dynamic VLAN assignment with RADIUS is working now as I expect and the weird management VLAN issue I was having is no longer happening.

 

I've given it a bit of a test but far from extensive and not found any issues. Perhaps there's some other issue with the firmware that is holding them back from making the release fully available but at least for now it's working for me.

 

I got the firmware from the support website https://www.tp-link.com/au/support/download/eap650/v1/#Firmware & https://www.tp-link.com/au/support/download/eap670/v1/#Firmware (which is for AU version of rev1.0 hardware for both models).

Recommended Solution
  0  
  0  
#19
Options
18 Reply
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-03 23:00:46

I've just noticed that for the EAP670 on the US site & German site there is a 1.0.6 firmware but on the Australian site there is only 1.0.2 even though the device shipped with 1.0.3.

 

For the EAP650 it is even more inconsistent. I have the H/W revision 1.0 which has no links to firmware at all and depending on my choice or H/W revision and region I get options ranging from nothing to 1.0.3 or 1.0.6.

 

There is a recommendation against upgrading a device to a firmware from a different region or hardware revision but is that actually a problem, especially if I still stick with a EU version?

 

Can I ask someone from TP-Link (I've seen @Fae respond to several similar posts) to either provide me with links to compatible firmware for the AU region (EU hardware) or update the websites with one if an official one is available.

 

 

 

  0  
  0  
#2
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-04 00:35:18

  @bky This is a known issue with the newer EAP6XX APs, only the first versions of the 610/620/660 are PPSK compatible.  TPLink has promised a firmware update to fix it since July, 2022, but we still wait.  It is available with the beta firmware in the pinned post in this forum, and there was a momentary release of an official firmware that got pulled due to reboot cycle after flashing.

  1  
  1  
#3
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-04 03:37:31

Thanks @JoeSea. That is what I figured for PPSK. Do you know about RADIUS VLAN assignments? Is that supported in current firmware versions?

  0  
  0  
#4
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-04 06:22:43

  @bky 

 

Do you have the Omada Gateway? The FAQ 3152 steps is for a whole Omada network. If your switch/gateway are not tp-link, you may need to check the router VLAN settings and confirm you have VLAN tagged traffic to the EAP.

  0  
  0  
#5
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-04 07:37:08

Thanks @Somnus. I use a pfSense gateway, not Omada. The interface it is on supports VLAN tagged traffic, however, the management and device itself use untagged traffic, including the RADIUS handshake.

 

I'll try setting up a management VLAN on the devices and see how that goes.

  0  
  0  
#6
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-04 07:48:54

Dear  @bky 

bky wrote

 

Questions

  1. Do my EAP650 & EAP670 devices actually support dynamic VLAN assignment based on RADIUS? I note that the WebUI says only some devices support it and make sure the firmware is the latest, and I see some from Googling around that other features like PPSK &  MAC-based RADIUS are quite new and not supported by all devices but I can't find a list of what devices support what features and the WebUI provides no indication that some or all of my APs may not support the features enabled.

 

EAP650&EAP670 current firmware does not support Dynamic VLAN. It will be available on next firmware. 

 

It's supposed to be update very soon, maybe within 1-2 weeks.

 

Best Regards! >> Omada EAP Firmware Trial Available Here << >> Get the Latest Omada SDN Controller Releases Here << *Try filtering posts on each forum by Label of [Early Access]*
  3  
  3  
#7
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-06 13:01:55

@bky One other point regarding "Attempt 2: PPSK + Wifi 6", as far as I know PPSK without radius is fundamentally incompatible with Wifi 6 due to the way the handshake works. Wifi 6 PPSK with radius may be possible in future. This is touched on in some other network providers forums, eg meraki, but it won't allow me to post the link here.

  1  
  1  
#8
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-17 01:44:15

I tried RADIUS VLAN assignments after enabling the Management VLAN on the EAPs and it results in some rather odd behaviour but still doesn't work.

 

When I setup the EAP after a factory reset to have a management VLAN it works as expected - the EAP communicates entirely on that VLAN, I can manage it via the WebUI, adopt it by the controller and then manage it perfectly fine from the controller, however, as soon as any client attempts to connect over the AP and it performs the RADIUS handshake for that client the EAP partially forgets about the management VLAN and drops back to a quasi-untagged state where it responds to inbound packets on the management VLAN but sends all outbound packets as untagged packets. The only way I've been able to get it out of that state is a factory reset.

 

I guess I'll wait for the new firmware to drop and see how that goes.

  0  
  0  
#9
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-17 03:03:30

  @bky The EAP650(US) firmware update came out today.  At this point I wait a week after firmware update releases before installing them, to see if it will get pulled for some reason.

  0  
  0  
#10
Options
Re:Can't get WiFi dynamic VLAN assignment to work
2023-01-17 05:34:51 - last edited 2023-01-17 05:35:55

Fantastic! I also see it for EU too, but I'm in AU and don't see that one yet so will have to wait for it to come out for it, but good to know there is a version coming, so long as it doesn't get pulled.

  0  
  0  
#11
Options