In my test network, I created a connection between a router, switch and the wireless access point. Both router and access point were connected to the switch via a trunk-ed connection, which allows multiple network ranges to be transmitted over one connection. I then created 3 DHCP pools on the router, the first one for management connections (& native vlans), and the second & third being the two test wireless networks that'll be allocated to different SSID's (Network10 & Network20).
The first step was to create an SSID, allocate a Vlan which it's use, along with setting it's authentication method and password.
Dot11 ssid <NetworkName>
>Vlan <ID>
>Authentication open
>Authentication key-management wpa
>wpa-psk ascii <0/7> <password>
>Mbssid Guest-mode
Next was to go on to the wireless interface, and apply the encryption used on each Vlan. Then the SSID's that'll be broadcasted via the wireless interface. Lastly "Mbssid" to tell the interface that there are to be multiple networks broadcasted.
Interface dot11Radio <0/1>
>encryption vlan <ID> mode ciphers tkip
>ssid <NetworkName>
>Mbssid
As there are all multiple wireless networks sharing single interfaces, I had to enable encapsulation. The "bridge-group" command binds the radio interface with the fastEthernet connection. I used the same numbers as what I used on the Vlans to avoid confusion.
Interface dot11Radio <0/1>.<ID>
>encapsulation dot1Q <ID>
>bridge-group <ID>
Interface fastEthernet 0.<ID>
>encapsulation dot1Q <ID>
>bridge-group <ID>
The last commands I needed to apply was "bridge irb", because the access point doesn't do routing and finally to turn on the interface.
bridge irb
Interface dot11Radio <0/1>
>no shutdown
Next I did the testing.
![]() |
When scanning for wireless connections, both of my networks "Network10" & "Network20" came up with authentication. Like what I set above, the security was "WPA PSK".
![]() |
| As shown, when I've connected to each of the wireless networks it allocated different IP addresses and default gateways. |
![]() |
| Above is a screenshot from the router, showing the addresses that had been given via DHCP. You can see the two different addresses that my phone was allocated, as it has the same MAC address. |
Next step will be to get the same idea working over a layer 3 network.



No comments:
Post a Comment