User Guide: AWC plug-in version 3.15.0 for VST-APL

# Dynamic VLAN with WPA Enterprise

Dynamic VLAN allows you to dynamically assign a separate VLAN to each wireless client (or a user of the device) according to the authentication credentials received from a RADIUS server.
Dynamic VLANs can be used for WPA Enterprise authentication or MAC Access Control.
To use Dynamic VLAN with WPA Enterprise, please refer to Configure AP Profiles to configure WPA Enterprise and specify the RADIUS server. At this time, you also need to enable the "Dynamic VLAN" setting in the advanced settings section of WPA Enterprise.

> Note

> > To use Dynamic VLAN with Captive Portal, you have to configure WPA Enterprise.

## Configure RADIUS Server

To use Dynamic VLAN, you have to add the APs to the RADIUS server's database as RADIUS clients.

Table 1: RADIUS client information to add to the RADIUS database.
Item Name | Description
--- | ---
RADIUS Client's IP Address | Wireless AP's IP Address (Example) 192.168.1.230
Secret | Wireless AP's Password (Example) "MyPassword"

> Note

> > To allow the APs to carry out authentication, add all APs to the RADIUS client database.

> Note

> > Refer to the RADIUS server's documentation for detailed instructions of how to configure the server.

If you use Dynamic VLAN, create user entries in the RADIUS database that contain the following VLAN-related attributes in addition to username and password.

Table 2: User Attributes for Dynamic VLAN
Attribute Name | Attribute Value | Comment
--- | --- | ---
User-Name | Full Name | The username to authenticate (eg. "user1", "user2")
User-Password | Password | (When using PEAP(EAP-MSCHAPv2) or TTLS) The password for the user (eg. "passwd1", "passwd2") This is not required when using EAP-TLS (but the user certificate is required)
Tunnel-Type | VLAN (13) | Fixed value. See the RADIUS server documentation for configuration.
Tunnel-Medium-Type | IEEE-802 (6) | Fixed value. See the RADIUS server documentation for configuration.
Tunnel-Private-Group-ID | VLAN ID | The VLAN ID that you want to assign to the user when they are successfully authenticated. (eg. 100, 200)

> Note

> > When packets from the user (wireless client) are forwarded to the wired (ethernet) port of an AP, the VLAN ID is added to the packets.

> Note

> > If you use WPA Enterprise along with Captive Portal or MAC Access Control, RADIUS attributes used for determining client VLANs should be configured as the ones for WPA Enterprise, not for Captive Portal or MAC Access Control.
> > In those cases, VLAN attributes received during Captive Portal or MAC Access Control are ignored.

> Note

> > To use EAP-TLS, certificates for the RADIUS server, certification authorities (CAs), and each client (user) should be properly installed on hosts. To use EAP-PEAP or EAP-TTLS, certificates for the RADIUS server and CAs should be properly installed on hosts. Refer to documentation for the RADIUS server and supplicant for more details.

## When used with MAC Access Control or Captive Portal

When WPA Enterprise authentication and MAC Access Control are used together, the wireless client will use the VLAN determined during WPA Enterprise authentication.
This means that if the user's VLAN is set in the authentication information of the RADIUS server referenced by the WPA Enterprise, that VLAN will be applied.
If the AP doesn't receive any VLAN information during a WPA Enterprise authentication, the client's traffic will be handled on a VLAN that is configured for the VAP.
As a result, VLAN attributes received during MAC Access Control will be discarded.
This is the same case as Captive Portal being used with WPA Enterprise and MAC Access Control.

> Note

> > When Captive Portal, MAC Access Control, and WPA Enterprise are used together, they are processed in the order of "MAC Access Control" -> "WPA Enterprise" -> "Captive Portal".

10 Nov 2025 11:47