# AWC Plug-in User Guide 3.1.0

# Dynamic VLAN with WPA Enterprise

Configure RADIUS Server
When used with MAC Address Authentication or Captive Portal

Dynamic VLAN allows you to dynamically assign a separate VLAN to each wireless client (or a user of the device) according to the authentication credentials received from a RADIUS server.
Dynamic VLAN can be used with either WPA Enterprise authentication or MAC Address Authentication.
To use Dynamic VLAN with WPA Enterprise authentication, configure WPA Enterprise and RADIUS servers. Please refer to Configure AP Profiles for details. Make sure you enable "Dynamic VLAN" while configuring WPA Enterprise.

> Note

> > Dynamic VLAN is only supported by TQ series.

> Note

> > To use Dynamic VLAN with Captive Portal, you have to configure WPA Enterprise.

## Configure RADIUS Server

To use Dynamic VLAN, you have to add the APs to the RADIUS server's database as RADIUS clients.

Table 1: RADIUS client information to add to the RADIUS database.
Item Name | Description
--- | ---
RADIUS Client's IP Address | Wireless AP's IP Address (Example) 192.168.1.230
Secret | Wireless AP's Password (Example) "MyPassword"

> Note

> > To allow the APs to carry out authentication, add all APs to the RADIUS client database.

> Note

> > Refer to the RADIUS server's documentation for detailed instructions of how to configure the server.

If you use Dynamic VLAN, create user entries in the RADIUS database that contain the following VLAN-related attributes in addition to username and password.

Table 2: User Attributes for Dynamic VLAN
Attribute Name | Attribute Value | Comment
--- | --- | ---
User-Name | Username | The username to authenticate (eg. "user1", "user2")
User-Password | Password | (When using PEAP(EAP-MSCHAPv2) or TTLS) The password for the user (eg. "passwd1", "passwd2") This is not required when using EAP-TLS (but the user certificate is required)
Tunnel-Type | VLAN (13) | Fixed value. See the RADIUS server documentation for configuration.
Tunnel-Medium-Type | IEEE-802 (6) | Fixed value. See the RADIUS server documentation for configuration.
Tunnel-Private-Group-ID | VLAN ID | The VLAN ID that you want to assign to the user when they are successfully authenticated. (eg. 100, 200)

> Note

> > When packets from the user (wireless client) are forwarded to the wired (ethernet) port of an AP, the VLAN ID is added to the packets.

> Note

> > If you use WPA Enterprise along with Captive Portal or MAC Address Authentication, RADIUS attributes used for determining client VLANs should be configured as the ones for WPA Enterprise, not for Captive Portal or MAC Address Authentication.
> > In those cases, VLAN attributes which are received during Captive Portal or MAC Address Authentication are ignored.

> Note

> > To use EAP-TLS, certificates for the RADIUS server, certification authorities (CAs), and each client (user) should be properly installed on hosts. To use EAP-PEAP or EAP-TTLS, certificates for the RADIUS server and CAs should be properly installed on hosts. Refer to documentation for the RADIUS server and supplicant for more details.

## When used with MAC Address Authentication or Captive Portal

If you use WPA Enterprise along with MAC Address Authentication, a wireless client will be assigned to the VLAN that is determined during WPA Enterprise authentication.
In other words, if an AP receives VLAN attributes during a WPA Enterprise authentication for the client, the AP assigns the VLAN to the client.
If the AP doesn't receive any VLAN information during a WPA Enterprise authentication, the client's traffic will be handled on a VLAN that is configured for the VAP.
As a result, VLAN attributes that are received during MAC Address Authentication will be discarded.
It's the same with the case where Captive Portal is being used with WPA Enterprise and MAC Address Authentication.

> Note

> > When Captive Portal, MAC Address Authentication, and WPA Enterprise are used together, they are processed in the order of "MAC Authentication" -> "WPA Enterprise" -> "Captive Portal".

> Note

> > MAC Address Authentication and Captive Portal are only supported by single-band / dual-band TQ series.

13 Mar 2020 16:32