- [Narrator] A Cisco Wireless LAN Controller
can come in a few forms.
A physical piece of dedicated hardware,
a VM image,
or embedded in some catalyst switches.
When in physical form,
they often have multiple interfaces
that can be used for connectivity.
A common practice to gain more
throughput and additional redundancy
is to form an EtherChannel between
the wireless LAN controller
and the switching infrastructure
connecting to the APs.
This is often referred to as
a Link Aggregation Group, or LAG.
Access points generally
physically connect to switches
via trunk ports.
Trunk ports allow for multiple
VLANs to go to the access point,
which gives an administrator
the most flexibility.
For security purposes,
it's a best practice to
place the management interface of network equipment,
regardless if it's an AP, switch, or phone,
into a management VLAN.
This will segregate user traffic from management.
So not only does trunking allow
management traffic to be in a different VLAN,
it's also common practice to place
different users into different VLANs.
One approach to multiple VLANs
is to have multiple SSIDs,
each putting connected users
into a different VLAN.
This approach can help things
stay simple for troubleshooting,
as in,
wireless accounting people should
always be in the wireless accounting VLAN.
There are other, more clever ways
to assign a wireless client to a VLAN.
There's a networking protocol known as RADIUS,
that provides centralized authentication,
authorization, and accounting management
for users or devices that connect to a network.
In this instance,
a client will first connect to an SSID.
The client device will then authenticate
against a centralized RADIUS server.
If the client successfully authenticates,
the RADIUS server will send back
specific attributes to the AP,
telling it which VLAN to connect the client to.
The AP will then bridge all the devices' frames
into that specific VLAN.
This means that a company can have a single
enterprise SSID,
say for example,
Company X.
When an accounting user connects
to the Company X SSID,
they'll bridge into VLAN 10 for accounting.
When someone from logistics connects
to the same SSID, on the same AP,
they're bridged into VLAN 15 for
logistics users only.
This effectively segregates each departments'
traffic from each other.
Access points in wireless LAN controllers
can be administered much like any other
networking equipment, utilizing
Telnet, SSH, HTTP, HTTPS, and Console access.
Though lightweight APs can generally
be directly connected to,
once they are added
to a wireless LAN controller,
there is little reason to
make a direct connection
as configurations should be
performed via the controller.
Centralized authentication is a solid decision,
no matter the network size or complexity.