@Clive_A It's quite conveinient to create multiple VLAN on the same physical interface. But why use the same DHCP pool for all these VLAN? Can I use different DHCP pool for different VLAN? I think it's not very practical to use one DHCP pool/Subnet for different VLAN either. Firstly, not easy for management. Secondly, the IP address may not be enough. On this example, there are only 254 IP address shared by 20 VLAN/SSID, I think for most scenarios, it's not enough.

  @Clive_A You are correct and wrong.

The main benefits of the Bridge VLAN is that, for an ordinary Gateway, it's easy to support 4096 VLANs. But even for a high end Cisco Router/Gateway, it's not capable to support 256 VLAN interfaces even.

  @Clive_A I tried setting up a Bridge VLAN today for a client according to your directions. If I understand your example, it describes setting up an SSID for each of the Bridged VLANs. The problem is that you run out of SSIDs. Your unfinished example only has 4 SSIDs created, but 20 VLANs. If you have an AP in each apartment/room with only 2 frequencies available, then most likely you have only 2.4 and 5 GHz available with 16 SSIDs total or 8 if you use both frequencies at the same time for each SSID as in most setups. So, your instructions seem flawed. If I misunderstand, kindly help me to understand.

I was able to modify your setup slightly to achieve a working result. In my scenario, the client owns 17 apartments above 6 shops. I want each apartment and each shop to have its own isolated VLAN, so each apartment or shop can securely share devices on their own VLANs. Each apartment has an EAP615 AP and each shop has an EAP610 AP. The router is an ER7206 with an OC200 controller. There are SG2428P and SG2218P switches.

I started by creating 2 Bridge VLANs. The first was called Apartments with 17 VLANs and the second called Shops with 6 VLANs. Your Notes said that each Bridge VLAN should have a maximum of 20 VLANs for the sake of performance and that's why I made the 2 Bridge VLANs. Next, I created a PPSK profile called "Tenant" with 23 passwords linked to 23 VLANs.The VLANs in the PPSK Tenant profile are the same ones in the 2 Bridged VLANs (Apartments and Shops). I created one SSID that uses PPSK without RADIUS to authenticate. This allows all users to enter the same SSID and authenticate to their own VLAN based on their own personal password. I followed up by creating the Gateway ACL the way you specified to block access to the default LAN.

To make things even better, I went to the port configuration for the EAP615 AP for each apartment and configured the 3 Ethernet ports to match the VLAN ID for that apartment. So, whether the apartment tenants use the Ethernet ports or the SSID with the password for that apartment network, they are on the same VLAN ID and can share devices.

Cheers!

  @Kenallo What you said is confusing. You said, "Bridge VLAN is not targeted for such use cases." But then you go on to say, "Bridge VLAN is typically for PPSK use case where you have more VLANs, but not enough VLAN interface/DHCP pool." and "But your gateway can only support 64 VLAN interfaces." Isn't an Apartment or Hotel scenario exactly this scenario with this dilemma? And was not my solution using the use case you mentioned? Then how can you say the Bridge VLAN is not targeted for such use cases?

You also said, "Omada is a solution for Business Wi-Fi, and for Business Wi-Fi". From TP-Link's websites I quote regarding Omada, "Seamless wireless and wired connections are provided, ideal for use in hospitality, education, retail, and offices." Hospitality includes Hotels. TP-Link produced the following article to which I link regarding their release of the EAP615 wall mount AP.

https://community.tp-link.com/en/business/forum/topic/517094

It states it is "more suitable for high-density application scenarios such as hotels, dormitories, and classrooms." They expect us to use their Omada equipment for these situations, but you argue that Omada is not for these use cases.

Further, if a Bridge VLAN is not targeted for Apartment or Hotel scenarios, why did TP-Link produce this very discussion as a direct solution for these scenarios (albeit flawed)? And when I asked TP-Link support engineers for a solution for Apartment VLAN isolation support, why did they link this article and say this is how it is done.

I must disagree with you. This is TP-Link's solution, applying directly to this use case and included as a purpose for the Bridge VLAN isolation solution.

  @Icthus 

you should consider PPSK, then you only need one SSID for all vlans. it is the only way to solve your problem. on.

https://community.tp-link.com/en/business/forum/topic/620762

it is a little more work, but you can also create a wlan group for each apartment, if all apartments and shops have their own wifi device, then you assign these devices to their wlan group.

MR.S wrote

  @Icthus 

 

you should consider PPSK, then you only need one SSID for all vlans. it is the only way to solve your problem. on.

 

 

https://community.tp-link.com/en/business/forum/topic/620762

 

it is a little more work, but you can also create a wlan group for each apartment, if all apartments and shops have their own wifi device, then you assign these devices to their wlan group.

 

  @MR.S It is an absolute pleasure to hear from you (if you read on you will eventually see why). In my own scenario a few weeks ago, I started by using your suggestion of a PPSK using one SSID for all VLANs without using a Bridged VLAN operation, but that did not work. Why? We want to isolate the VLANs for security. If we use that solution, we need many more than the 32 allowed ACLs for a situation like my 23 VLANs. So that suggestion is a bust. It was a good though and I had it because of you actually! In a previous community thread I had asked a question and you suggested it as a better solution. I thought, "That's a FANTASTIC idea!!!" But in the end it was a bust, because of the hard limit of 32 ACLs. Mind you, until November of 2022 it worked because there were a lot more ACLs allowed and this post

https://community.tp-link.com/en/business/forum/topic/589956?sortDir=DESC&page=1

flames TP-Link for their firmware update without notifying anyone that they were going to establish a hard limit of 32 ACLs. That's the history of the dilemma.

That said, I DID use your FANTASTIC idea to modify the OPs flawed solution to make the Bridged VLANs work. Bridged VLANs are AUTOMATICALLY isolated, so no ACLs are needed to isolate each VLAN. Combining the OPs idea of Bridged VLANs and your FANTASTIC idea (have I said that enough to tell you how amazing your idea was? ) of PPSK using one SSID gives us a working solution. In addition, because I don't need to create a massive number of ACLs to isolate the VLANs, it's a much easier solution to implement. SO MUCH EASIER!

The only downside I see is that you must use WPA2 and not WPA3 for the PPSK solution and eventually WPA2 will run into security issues. it's not a downside for today, but eventually. Then we will have to abandon it as we did WEP and WPA and come up with another solution that works with WPA3. I for one would like to hear suggestions for that solution, so we're ready for it, but that is probably best suited for another thread.