This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.Two SSID, Two VLAN, One Cable.
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Two SSID, Two VLAN, One Cable.
Model :
Hardware Version :
Firmware Version :
ISP :
Hi All, Guy's!
I install various EAP antennas (120 and 110) in a small industry, now i must create an Guest Wireless.
No problem with two SSID, but i must divide the network, because there's a lot of service in the business wireless.
So, i want the "Business WiFi" in a VLAN ID 100 and the "Guest WiFi" in VLAN ID 200.
My problem is separate the traffic of these two network, every antenna tag the packet from the SSID, but the switch can accept only one VLAN, right?
I want to connect the business wifi on the business network, with a server and more and the guest wifi directly on internet.
Thank You for every Answers!:D
Hardware Version :
Firmware Version :
ISP :
Hi All, Guy's!
I install various EAP antennas (120 and 110) in a small industry, now i must create an Guest Wireless.
No problem with two SSID, but i must divide the network, because there's a lot of service in the business wireless.
So, i want the "Business WiFi" in a VLAN ID 100 and the "Guest WiFi" in VLAN ID 200.
My problem is separate the traffic of these two network, every antenna tag the packet from the SSID, but the switch can accept only one VLAN, right?
I want to connect the business wifi on the business network, with a server and more and the guest wifi directly on internet.
Thank You for every Answers!:D
Re:Two SSID, Two VLAN, One Cable.
Your picture shows it very clearly: the EAP is connected to the switch over a trunk carrying both VLAN's traffic, this means data packets including the VLAN ID. The switch then can separate and forward all packets with VLAN ID 200 to a specific port (say, port 2) and all packets with VLAN ID 100 to another port (say, port 1). You connect the system running the Captive Portal to port 2 of the switch (the
guest network) and the Internet router to port 1 (the
private network). The switch will remove the VLAN IDs before passing data to ports 1 or 2.
To be able to do so, the switch needs to be a managed switch (a TP-Link EasySmart switch for example).
This is such an example setup:
If the captive portal is a software rather than a separate device it can also run directly on the router connecting to the Internet (which is missing at all in your picture!). Then, you would not use an external switch, but the built-in switch of the router, which can separate and forward data from different VLANs into different subnets.
In other words: if the Captive Portal, the Internet router and the switch from your picture above are running on the same device, then the trunk from EAP connects directly to the switch of this device.
For example, let's assume you have a router running some kind of Linux system (e.g. OpenWRT). You installed a captive portal such as wifidog or similar and you also have a VLAN-capable switch built into the router. You then create three networks wan, guest and private. You assign the VLAN ID 200 to the guest network and VLAN ID 100 to the private network.
One port of the router needs to connect to the Internet, it is assigned to the network wan. A second port connects to the EAP carrying both VLANs 100 and 200 (the trunk). If this port is assigned to both VLANs 100 and 200, the built-in switch of the router can separate the data (much like in the example with a standalone switch described above) and forwards it over kind of internal "wiring" into one of the networks corresponding to the VLAN ID, that's 100 for private and 200 for guest. The firewall then captures packets from the guest network and redirects them to the Captive Portal software. Data in the private network is just forwarded to the wan.
The functionality is the same as the scheme using an external managed switch, only the connections from ports 1 and 2 are now internal between the router's switch logic and the CPU. Anyway, data will end up in either the guest (ID 200) or the private (ID 100) network.
Did this better answer your question?
To be able to do so, the switch needs to be a managed switch (a TP-Link EasySmart switch for example).
This is such an example setup:
If the captive portal is a software rather than a separate device it can also run directly on the router connecting to the Internet (which is missing at all in your picture!). Then, you would not use an external switch, but the built-in switch of the router, which can separate and forward data from different VLANs into different subnets.
In other words: if the Captive Portal, the Internet router and the switch from your picture above are running on the same device, then the trunk from EAP connects directly to the switch of this device.
For example, let's assume you have a router running some kind of Linux system (e.g. OpenWRT). You installed a captive portal such as wifidog or similar and you also have a VLAN-capable switch built into the router. You then create three networks wan, guest and private. You assign the VLAN ID 200 to the guest network and VLAN ID 100 to the private network.
One port of the router needs to connect to the Internet, it is assigned to the network wan. A second port connects to the EAP carrying both VLANs 100 and 200 (the trunk). If this port is assigned to both VLANs 100 and 200, the built-in switch of the router can separate the data (much like in the example with a standalone switch described above) and forwards it over kind of internal "wiring" into one of the networks corresponding to the VLAN ID, that's 100 for private and 200 for guest. The firewall then captures packets from the guest network and redirects them to the Captive Portal software. Data in the private network is just forwarded to the wan.
The functionality is the same as the scheme using an external managed switch, only the connections from ports 1 and 2 are now internal between the router's switch logic and the CPU. Anyway, data will end up in either the guest (ID 200) or the private (ID 100) network.
Did this better answer your question?
༺ 0100 1101 0010 10ཏ1 0010 0110 1010 1110 ༻
Re:Two SSID, Two VLAN, One Cable.
R1D2 wrote
Your picture shows it very clearly: the EAP is connected to the switch over a trunk carrying both VLAN's traffic, this means data packets including the VLAN ID. The switch then can separate and forward all packets with VLAN ID 200 to a specific port (say, port 2) and all packets with VLAN ID 100 to another port (say, port 1). You connect the system running the Captive Portal to port 2 of the switch (the guest network) and the Internet router to port 1 (the private network). The switch will remove the VLAN IDs before passing data to ports 1 or 2.
To be able to do so, the switch needs to be a managed switch (a TP-Link EasySmart switch for example).
This is such an example setup:
If the captive portal is a software rather than a separate device it can also run directly on the router connecting to the Internet (which is missing at all in your picture!). Then, you would not use an external switch, but the built-in switch of the router, which can separate and forward data from different VLANs into different subnets.
In other words: if the Captive Portal, the Internet router and the switch from your picture above are running on the same device, then the trunk from EAP connects directly to the switch of this device.
For example, let's assume you have a router running some kind of Linux system (e.g. OpenWRT). You installed a captive portal such as wifidog or similar and you also have a VLAN-capable switch built into the router. You then create three networks wan, guest and private. You assign the VLAN ID 200 to the guest network and VLAN ID 100 to the private network.
One port of the router needs to connect to the Internet, it is assigned to the network wan. A second port connects to the EAP carrying both VLANs 100 and 200 (the trunk). If this port is assigned to both VLANs 100 and 200, the built-in switch of the router can separate the data (much like in the example with a standalone switch described above) and forwards it over kind of internal "wiring" into one of the networks corresponding to the VLAN ID, that's 100 for private and 200 for guest. The firewall then captures packets from the guest network and redirects them to the Captive Portal software. Data in the private network is just forwarded to the wan.
The functionality is the same as the scheme using an external managed switch, only the connections from ports 1 and 2 are now internal between the router's switch logic and the CPU. Anyway, data will end up in either the guest (ID 200) or the private (ID 100) network.
Did this better answer your question?
Thanks a lot man!
So i need to set the "input" port (ap) as tagged member of vlan 100 and 200.
Set the "output" port for vip network as untagged member of vlan 100.
And set the "output" port for the captive portal as untagged member of vlan 200?
Another question, i can create a trunk between two switch on the main backbone? (SFP port)
For do this, i need to set (on both switch) the sfp port as tagged member of 100, 200 and 1 (for untagged traffic), right?
Thanks a lot for your help! :)