![background image](http://html1.mh-extra.com/html/amx/nxa-wapzd1000/nxa-wapzd1000_operation-reference-manual_2937893072.webp)
Configure Tab
68
NXA-WAPZD1000 ZoneDirector Smart WLAN Controller
8.
Go to Administer > Restart, and click Restart to reboot the NXA-WAPZD1000.
How Dynamic VLAN Works
By default, all wireless clients associated with APs managed by the NXA-WAPZD1000 are segmented into a
single VLAN (with VLAN ID 1). If you want to segment wireless clients into different VLANs (for example,
for security purposes), you can enable dynamic VLAN.
Dynamic VLAN allows the NXA-WAPZD1000 to separate wireless clients into different network segments
based on the VLAN ID that is assigned to each wireless user on the RADIUS server. As such, dynamic VLAN
is implemented on a per-user basis.
Dynamic VLAN requirements:
A RADIUS server must have already been added to the NXA-WAPZD1000
WLAN authentication method must be set to 802.1X/EAP
WLAN encryption method must be set to WPA or WPA2
How Dynamic VLAN works:
1.
User associates with a WLAN on which Dynamic VLAN has been enabled.
2.
The AP requires the user to authenticate with the RADIUS server via the NXA-WAPZD1000.
3.
When the user completes the authentication process, the NXA-WAPZD1000 sends the join approval for
the user to the AP, along with the VLAN ID that has been assigned to the user on the RADIUS server.
4.
User joins the AP and is segmented to the VLAN ID that has been assigned to him.
For dynamic VLAN to work, you must configure the following RADIUS attributes for each user:
Tunnel-Type: Set this attribute to VLAN.
Tunnel-Medium-Type: Set this attribute to IEEE-802.
Tunnel-Private-Group-ID: Set this attribute to the VLAN ID to which you want to segment this
user.
Depending on your RADIUS setup, you may also need to include the user name or the MAC address of the
wireless device that the user will be using to associate with the AP.
Here is an example of the required attributes for three users as defined on Free RADIUS:
0018ded90ef3
User-Name = user1,
Tunnel-Type = VLAN,
Tunnel-Medium-Type = IEEE-802,
Tunnel-Private-Group-ID = 0014
00242b752ec4
User-Name = user2,
Tunnel-Type = VLAN,
The NXA-WAPZD1000 will need to be rebooted after changing management VLAN
settings.
When configuring or updating the management VLAN settings, make sure that the
same VLAN settings are applied on the
Configure > Access Points > Access Point
Policies > Management VLAN
page, if APs exist on the same VLAN as the NXA-
WAPZD1000.
RADIUS user attributes related to dynamic VLAN
Attribute
Type ID Expected Value (Numerical)
Tunnel-Type
64
VLAN (13)
Tunnel-Media-Type
65
802 (6)
Tunnel-Private-Group-Id
81
VLAN ID
Summary of Contents for NXA-WAPZD1000
Page 4: ......
Page 12: ...viii NXA WAPZD1000 ZoneDirector Smart WLAN Controller Table of Contents ...
Page 16: ...Introduction 12 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 130: ...Blocking Client Devices 126 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 146: ...Smart Mesh Networking Best Practices 142 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 153: ...Troubleshooting 149 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...