How can I implement VLANs across WLAN links?
Virtual LANs (VLANs) are used to subdivide one local area network into several logically isolated broadcast domains, independent of physical topology. The LAN being subdivided into logical pieces can be any type of LAN -- including Ethernet or Wi-Fi.
Port-based VLANs rely on switch or AP configuration to enforce VLAN membership. For example, a switch can be configured to put ports 1 through 8 into VLAN #1 and ports 9 through 16 into VLAN #2. Every station in VLAN #1 will hear the same LAN broadcasts, but nobody in VLAN #2 will be able to do so. Similarly, a wireless AP can be configured to relay traffic to and from VLAN #1 onto a named network (SSID) while relaying traffic to and from VLAN #2 onto a different SSID. That technique is commonly used to segregate guest wireless traffic from other (private) wireless traffic on the wired network.
Alternatively, 802.1Q uses tags (VLAN IDs) carried inside LAN frames to segregate traffic and keep it separated. VLAN tags let 802.1Q-capable devices like switches, APs, routers, and firewalls enforce VLAN segregation along the packet's entire path.
As described above, a wireless AP can be configured to apply a specific VLAN tag to each frame from a particular SSID. Or, wireless APs can receive VLAN tag assignments for each station during 802.1X authentication, supplied by a RADIUS server using RFC 3580. This technique can put individual users into the right VLAN, based on authenticated identity instead of the SSID they connect to.
VLANs can be extended all the way across an enterprise network, from branch office, across the WAN, to headquarters. A VLAN tag does not traverse this entire route because VLANs only apply to local area networks. However, routers and firewalls along the way can be configured to map VLAN tags onto network sub-interfaces.
For example, traffic from VLAN #1 might be routed onto VPN tunnel A as it traverses the Internet, while traffic from VLAN #2 would be routed through VPN tunnel B, etc. Traffic through both VPN tunnels would probably be transmitted over the same WAN link in between locations. In other words, VPN tunnels can keep layer 3 traffic segregated over IP networks, just like VLANs keep layer 2 traffic segregated over LANs.
Dig Deeper on Network Design
Related Q&A from Lisa Phifer
Understanding the functions of a wireless access point vs. wireless router will help you deploy the right device for the right circumstance. Continue Reading
Learn the difference between a site-to-site VPN and a remote-access VPN, as well as the protocols used for each one. Continue Reading
Need to send an email, check your flight's status or get ready for a presentation? You can do it all on your smartwatch, thanks to a slew of Apple ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.