Universal VLAN Reference Guide

Transcription

1 Universal VLAN Reference Guide Abstract This document describes a port-based virtual LAN (VLAN) architecture, in which any host connecting to a Vigor router by wire or wireless can become a member of one VLAN group. Under this architecture, a VLAN group may consist of wired, wireless members or both. The VLAN group of a wired host is determined based on the Ethernet port of Vigor router it connects to. The VLAN group of a wireless host, however, is decided through a WEB-based authentication procedure. Introduction Fig 1: A typical universal VLAN constitution. The universal VLAN framework consists of the following three parts: Wired VLAN Wireless VLAN Hybrid VLAN. The wired and wireless VLANs can be enabled individually. The hybrid VLAN defines the cross relationship between the wired and wireless VLANs and will not be effective unless both of the previous two are activated

2 Wired VLAN The wired VLAN is a port-based VLAN. One VLAN group comprises one or more Ethernet ports based on the user-defined configuration. The VLAN group of a wired host is decided based on the physical Ethernet port of the Vigor router it connects to. Wireless VLAN The wireless VLAN is a virtual port-based VLAN. One VLAN group comprises only one virtual port. An ID and password are assigned to the VLAN group for identification. The VLAN group of a wireless host is decided based on the ID/Password it provides during a login procedure. After associating with a Vigor router, a wireless host must provide a valid ID/password to Vigor through a specific URL, e.g. A built-in authentication database in Vigor is used to justify this information. If it matches with the ID/password of one VLAN group, the client will become a member of that VLAN and its access attributes will be applied to the host. Before finishing the login procedure, a host cannot access other parts of the network. However, hosts from WDS links are exceptions. They form a special VLAN group by default. Connection among this VLAN and other wireless VLAN groups should be set manually (see Wireless VLAN Setup). Hybrid VLAN This part defines the cross relationship among wired and wireless VLAN groups. One wired and one wireless VLAN group can be joined together to form a so called hybrid VLAN group. In this group, wired hosts can reach wireless hosts and vice versa. Figure 1 shows a typical universal VLAN constitution. - VLAN 1 is a wireless VLAN group consisting of three hosts, STA1, STA2 and STA3. Although they associate with different Vigor routers, Vigor 1 and Vigor 2, they can belong to the same VLAN group under the universal VLAN architecture. Notice that Vigor 1 and 2 are connected with a WDS link. - VLAN 2 is a wired VLAN group consisting of two hosts, PC1 and PC2. - VLAN 3 is a hybrid VLAN group. PC3 belongs to the wired VLAN group and STA4 and STA5 belong to the wireless VLAN group

3 Setup Procedure Please open VLAN menu. Wired VLAN Setup 1. Set the VLAN group for LAN port, P1 ~ P4. In this example, P1 belongs to wired VLAN0, P2 belongs to VLAN0 and VLAN1, P3 belongs to VLAN2 and P4 belongs to VLAN3. 2. If wireless VLAN is not enabled, all wired hosts can reach all wireless hosts and vice versa. Wireless VLAN Setup 1. Set the Login ID and Password for each wireless VLAN group, W_VLAN0 ~ W_VLAN15. For one wireless VLAN group, the following attributes can be specified: Activated Date. Expired Date. Connection to the WDS VLAN group. Isolate each host in this VLAN group

4 Note: Attribute IV is useful when members in a wireless VLAN group cannot trust each other but they should have the same access right to other parts of the network, for example, visitors to an office. 2. Disable or enable broadcast multicast traffic. Note: If this attribute is checked, all packets transmitted on the air will be unicast. This provides a very secure VLAN since no traffic will go out of a VLAN group boundary. However, the wireless throughput will decrease as the number of active wireless VLAN host increases. 3. After a wireless client associates with the Vigor router, it should use one of the following URL to login a VLAN group:

5 Notes: * Assume is Vigor s LAN IP address. * HTTPS is only available on some models. * In case III and IV, the IP settings of the client must be retrieved from Vigor automatically. 4. Type in an ID and password, which are case sensitive, press OK button and the next web page will show the authentication result. A small status page will also pop out at the same time

6 Notice that a wireless client can login again with the same or a new account without logout. If the client disassociates with the Vigor router without logout, its login record will be removed automatically by Vigor. 5. If wired VLAN is not enabled, all wireless hosts can reach all wired hosts and vice versa. Hybrid VLAN Setup Select VLAN Cross Setup and set up the following configuration table. In this table, the horizontal coordinate is the wired VLAN group and the vertical is the wireless VLAN group. If the box between a wired group, VLANi, and a wireless group, W_VLANj, is checked, they form a hybrid VLAN group. In this group, hosts in VLANi can reach hosts in W_VLANj and vice versa. In the above table, 8 hybrid VLAN groups are defined: (VLAN0, W_VLAN0), (VLAN0, W_VLAN1), (VLAN0, W_VLAN2), (VLAN0, W_VLAN3), (VLAN0, WDS), (VLAN1, W_VLAN4), (VLAN1, W_VLAN5), (VLAN1, W_VLAN6). Note: Since W_VLAN0 and W_VLAN1 do not belong to the same hybrid VLAN group, hosts in W_VLAN0 cannot reach hosts in W_VLAN

7 Wireless VLAN Rate Control When wireless VLAN is enabled, the upload rate (client-to-vigor) and download rate (Vigor-toclient) for each wireless VLAN group can be restricted through Wireless VLAN Rate Control. Notice that the specified rate is the aggregative rate for all clients in the same VLAN group