WESM zl Management and Configuration Guide WT.01.28 and greater

4-79

Wireless Local Area Networks (WLANs)

VLAN Assignment

The instructions for configuring a WLAN include the basic mechanics for assigning

all traffic from a WLAN to a VLAN.

This section will explain in more depth when and why you would assign one WLAN

to one VLAN and another WLAN to another VLAN. You will also learn about the

ability of the Wireless Edge Services zl Module to assign individual wireless users

to VLANs—an ability that provides a high degree of flexibility and control at the

edge of the network.

To understand the importance of the VLAN assignment, consider role of the Wireless

Edge Services zl Module as the guard between the wireless and wired portions of

your network. RPs encapsulate wireless traffic with Ethernet headers so wireless

users can access the wired network, but the module controls this traffic so that

wireless users receive the appropriate network access.

In a traditional Ethernet network, one of the primary ways in which administrators

control network rights is by assigning users to various subnetworks, or VLANs.

Traditionally, administrators used hardware-based rules to enforce these assign-

ments: they plugged a user’s workstation into a switch port configured to carry traffic

on the appropriate VLAN. However, you cannot control mobile users in a wireless

network in this way, because wireless users do not connect through a set port. Instead:

■ Users may connect through different ports at different times.

■ Traffic from many different users may arrive on the same port.

When you configure VLAN assignment on a Wireless Edge Services zl Module, you

enable the module to take over, for wireless stations, the role of assigning users to

the correct VLANs. In other words, you establish the foundation for control over

mobile users’ network rights. The module acts as an intelligent door to your network,

opening on the correct subnetwork for each wireless user.

You have a choice about how to treat the VLANs to which the module assigns wireless

traffic. If you want your wired infrastructure devices to handle this traffic, make sure

that on the wireless-services enabled switch you tag the module’s internal uplink port

for these VLANs. If you want the Wireless Edge Services zl Module to route the

wireless traffic into VLANs used on the wired network, you should not tag the internal

uplink port for the VLANs for wireless users. On the other hand, you might tag the

port for the wired VLANs (depending on whether the module has VLAN interfaces

for those VLANs or simply knows routes to them).