First off, you'll never do what you want to do unless the switchport that the access point is plugged into is set up to trunk vlans. Here is what you need to do. Let vlan 1 on the switch and give it a management IP as stated above. Next, create the vlan 3 on your core switch and all the switches that the access points are plugged into. Make sure that switches trunk back to the core where your Firewall is. It will look like this:
Switch---Trunk-----Core_Sw
The trunk will allow the vlans to get back to the core.
Next, on each access point, you will create your vlans, assigning the appropriate ESSID that you create along with any security to that vlan.
Looks like this:
GETMETOINTENET--maps_to_vl
On the switch port that the access point is plugged into, set it to trunk also. On a Cisco its:
switchport mode trunk
switchport trunk encapsulation do1Q
Attached you will find a sample configuration pulled from an Aironet 1131 using multiple ESSIDs assigned to multiple vlans with the FastEthernet trunked to the switchport that it is plugged into.
Once you have all ports trunked and the access points configured properly, take the OPT LAN port on the firewall and plug it into vlan 3. DO NOT ASSIGN ANY IP ADDRESSES TO VLAN 3 ON ANY SWITCHES! This will break the security that you're trying to set up. Once you have the OPT LAN port plugged in, test getting an IP address from the firewall. It should work.
Your end goal with all of this is to create a vlan3 on each access point trunk it along with your switches at layer 2 across your network back to your core switch. This is superior security. When a person goes to use the public internet they will be riding your network back to the firewall and then out onto the internet. They will have NO ACCESS to anything on your network, PERIOD! At layer 2, you can't leave the vlan so you have no access to anything. Since your firewall will be plugged into that vlan, it will be able to hand out ip's and get the users on the internet.
It is quite a bit of work but when it's done, you'll be very, very pleased. It's all simple to set up it's just going to take a while. If you need help with any of the configuration, please let me know.
Good luck!
Main Topics
Browse All Topics
by: kenboonejrPosted on 2009-08-18 at 13:51:56ID: 25127547
Ok to start off, since the 2950 is a layer 2 switch you can only have one layer 3 interface up on that box. So in other words you can't have interface vlan 1 and interface vlan 3.
The good news it that you don't have to. So basically your two ports will come off of your firewall and connect into two ports on the switch. The key is that you need to make sure that LAN 1 is connected to a vlan 1 port and OPT LAN is connected to a vlan 3 port.
Then for starters I would make another port vlan 3 and plug a laptop in and make sure it gets a dhcp address and that works.
The port where the AP is connected looks good assuming the native vlan on the AP is vlan 1.
I would give the switch an address on vlan 1 on the inside to simply your management and set the default gateway to whatever it should be for vlan 1 - and then just get rid of the vlan 3 interface on the switch.
Then the next part is dealing with your AP config. ;)