Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

4-86
Wireless Local Area Networks (WLANs)
VLAN Assignment
■ Who will be connecting to this WLAN?
• Guests—In this case as well, you could assign the WLAN to a VLAN
reserved for wireless users. Network administrators could then con-
trol traffic from that VLAN appropriately—for example, limiting wire-
less users to Internet access or to certain network servers.
• Employees who will use the wireless connection exclusively—
You can use the same policies to assign new employees to a VLAN
that you would use if the employees used traditional, wired connec-
tions. Then simply assign the WLAN to that VLAN.
If you want to assign different employees to different VLANs, then
you must configure a separate WLAN for each employee category and
ensure that the employees connect to the correct WLAN. Dynamic
VLAN assignment offers a more elegant solution and will be discussed
later in “Identity-Based, or Dynamic, VLAN Assignment” on page 4-88.
• Employees who will use the wireless connection as well as a
traditional connection—In this case particularly, you should focus
on the type of network access that the employees will require. If, for
example, the employees only need to check their email and access
the Internet, then you could group them all together in a WLAN and
VLAN that has been configured to allow such limited access.
If, on the other hand, the employees need access equivalent to wired
connections, then you must configure the Wireless Edge Services xl
Module to place each employee in the VLAN in which that employee
operates in the Ethernet network. In a network with a single user
VLAN, the process is straightforward enough: simply create a WLAN
and assign it to that VLAN.
However, to replicate, for wireless users, wired access to a network
with multiple VLANs, you must:
i. Determine the user VLANs to which mobile employees belong.
ii. Create one WLAN for each user VLAN, mapping each WLAN to a
different VLAN.
iii. Configure security on each WLAN such that only the employees
that should be placed in the corresponding VLAN can connect to
the WLAN.
Dynamic VLAN assignment, described in “Identity-Based, or
Dynamic, VLAN Assignment” on page 4-88, greatly simplifies this
process, while providing finer control.