Copyright © 2011, Juniper Networks, Inc.
5
APPLICATION NOTE - Configuring and deploying the AX411 Wireless Access Point
L3 Management Mode
In this mode, each access point is connected to a different subnet on the branch services gateway. Traffic between
access points is routed and inspected by the branch device.
Figure 2: L3 management mode
Analogous to these, customer traffic can be forwarded using either one of these modes on a per access point basis, i.e.,
any given access point can be connected to the gateway either in L2 or L3 mode. With this in mind, it is important to
understand the different tradeoffs between these modes.
Table 2: L2 vs. L3 Forwarding Mode
FeATuRe
L2 MODe
L3 MODe
Access point to access point
communication (and client to client
communication when clients are in
different access points)
done in hardware at line rate but without
any security inspection.
firewall and uTM services are available,
but at the expense of forwarding
performance.
firewall authentication
Not supported for L2 switched traffic.
yes
Client to client isolation
Not always possible (proxy-arp can be
used to force all client to client traffic to
be sent to the gateway, where security
policies can be enforced).
yes
Qos
Not supported for client to client traffic.
yes
Configuration complexity
simpler configuration, since a single L3
interface is shared between all access
points.
Complex, as each access point is
connected to a different L3 interface, with
each requiring the configuration of an IP
address, a dhCP server, security zones,
and policies.
roaming
Client roaming is supported, if MAC
authentication or no authorization
protocol is used. If authentication is used,
clients will have to log in every time they
associate to a new access point.
roaming will require clients to send a
new dhCP request in order to obtain a
new IP address.
Configuration
The configuration is found under [wlan] hierarchy. In Junos Os release 10.0, each access point has to be configured
individually. Junos Os 10.1 includes the ability to group access points into clusters, where all access points share the
same configuration. Access points in a cluster exchange both configuration and operational information and do not
require operators to make changes to each individual access point. The clustering feature will be discussed in a future
version of this document.
OFFICE
Client
INTERNET
ge-0/0/3.0
192.168.3.1/24
ge-0/0/2.0
192.168.2.1/24
ge-0/0/1.0
192.168.1.1/24
DHCP
Handles out addresses in multiple pools
(192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24)
Ports
All access point facing ports are connected to interfaces
in switching mode and associated to the default vlan
SRX
Series
