4 SSIDs 1 Secondary Academy – Intro + Diagrams

In this series of posts Im going to look at the technical setup required for providing 4 different SSIDs each on its own network (using VLANs) which provides wireless services for a variety of services.

For each of the networks I am looking to achieve something specific-

• OSA-WiFi – Domain joined Windows devices, served by computer authentication with the settings deployed through Group Policy
• OSA-MacWiFi – Domain joined Apple devices, WPA2-PSK with a Bonjour gateway to finish it all off to allow anything on this network to talk to our AirServer installation
• OSA-BYOD – ‘Bring your own device’ network for staff and students – as easy as possible to connect to using the Smoothwall 802.1x features
• OSA-Public – A regularly changed WPA2-PSK key (I did consider single use keys but then worked out it would need a lot of keys generated for when we have 100+ visitors!) to be used by visitors

To accomplish this I shall be using the following infrastructure components

• 1x HP MSM765zl Mobility Series Controller (housed in a HP 8212 Layer 3 Switch)
• 60x HP MSM460 Wireless Access Points (there are a few HP MSM466s in there for good measure as well)
• HP ProCurve wired infrastructure – a mixture of various Layer 2 switches with 1Gbit to the client and 10Gbit to the core
• 1x Windows Server 2012 running DHCP for 3 of the SSIDs (running as a virtual machine)
• 1x Windows Server 2012 running Network Access Protection to serve as a RADIUS server (running as a virtual machine)
• 1x Smoothwall UTM 1000 series Firewall/Web filter appliance

Before you go further… an understanding of DHCP on Windows Servers, VLANs (ideally on HP ProCurve) and Smoothwall Firewalls will greatly aid following this series of posts! In addition I’m sorry if this guide seems a little disjointed – hopefully with time I’ll work out a way to tidy it up.

Wireless Controller

The Wireless Controller sits in VLAN2 (Services) and has VLANs 10 (Windows Clients), 14 (Apple Clients), 17 (BYOD) and 18 (Public) tagged against it. For whatever strange and interesting requirement its a requirement of the HP MSM 765zl that I am using to have legs in these VLANs (with IP addresses) otherwise it can’t configure the APs to provide services on them.

Wireless Access Points

Shall we say it took a fair few days to track down and setup all 66 of the HP MSM460 wireless access points (the previous install was done by a managed service provider) but either way they sit in VLAN4 (Wireless APs only) and have VLANs 10, 14, 17 and 18 tagged on their interfaces.

Smoothwall Firewall

Bit of an interesting one here but it all makes sense. The Smoothwall sits in VLAN2 (services) and is tagged with VLANs 14, 17 and 18 each of which is configured with an IP address.

Next up!

In this next post I will look at the configuration of the HP ProCurve and MSM side of things (VLANs time!).