OMADA CLOUD CONTROLLER on VLAN
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello, I have the following query, because it is confusing all this vlan with the EAP.
I have 3 different networks in my network. for example:
LAN Offices 10.10.10.1/24 + (vlan20; vlan30)
LAN Students 10.10.20.1/24 + (vlan10; vlan30)
LAN Rooms10.10.30.1 / 24 + (vlan10; vlan20)
Each network is for different uses, for example offices, students and rooms.
The need arises to have EAP in all ranges, because not all cables reach everywhere.
2 EAP + omada controller on 10.10.10.1/24
2 EAP on 10.10.20.1/24
2 EAP at 10.10.30.1/24
create 3 wifi signals and their respective ssid
SSID: Offices
SSID: Students
SSID: Rooms
but what I need is more complete, I need to be able to place a VLAN to each EAP particularly
EAP that are DHCP 10.10.20.1, configure VLAN10, to see omada controller.
*Summary, I need to use EAP nodes in all wired IP ranges and that emit all ranges over Wi-Fi, I need that each EAP node has the option of choosing which VLAN to connect regardless of which VLAN emits over Wi-Fi.
am I clear?
ideas?
That's even better (a separated management network for OC200: VLAN 200).
But why then VID: 1? Port to OC200 must be an untagged member of VLAN 200 and needs to have PVID 200 to make it work.
No. Ports for EAPs with VLANs 10, 20, 30 and 200 must be all tagged (trunk ports). No untagged traffic to EAPs, this will not work with VLAN-aware Multi-SSIDs! Only OC200 needs to transmit untagged (management) traffic.
Of course, if you want to distribute a single VLAN, say 10, only to an EAP group (say, the two in Office space) you need to assign those EAP's ports only membership of VLAN 10 and 200, both tagged, but not VLAN 20 and 30. The port's PVID should be 200 then. But I think it's better to feed them all VLANs and enable/disable the SSID-VLAN per EAP where needed.
This is the topology:
Important information is missing:
- What is the Primary VLAN ID (PVID) of the ports?
- Are the ports tagged or untagged members of the VLANs?
If ports are untagged members, then VLAN 30 is unused in your setup.
So you have three networks/broadcast domains, but only one network per two EAPs. Why? I would rather distribute all three networks over all six EAPs.
Then why not just set it up? 
Let's see:
- You have three networks 10.10.10.0/24, 10.10.20.0/24 and 10.10.30.0/24. You assign them three VLAN IDs 10, 20 and 30.
- Port 8 should be the trunk port to your (VLAN-aware) router or to another switch to which the router is connected to.
- Management network for OC200/EAPs should be VLAN 10 (Office LAN).
- EAPs should use VLAN 10 for management and Office LAN access.
- All EAPs should offer all three networks wirelessly, one per SSID.
- All wireless users should be able to reach the portal(s) on OC200 over the Office network (VLAN 10).
Port assignment on the switch:
Port 1-6: EAPs. Port 7: OC200, Port 8: uplink to router.
VLAN setup:
- In the switch, create VLAN 10, 20 and 30 to fulfill requirement #1.
- Assign switch port 8 (uplink) membership of VLANs 10, 20 and 30 as tagged port (trunk port) with PVID 10. Requirement #2 met.
- Assign switch port 7 (OC200) membership of VLAN 10 as untagged port with PVID 10. Set OC200 to a static IP from the IP 10.10.10.0 network. Requirement #3 met.¹
- Assign switch ports 1-6 membership of VLAN 10, 20 and 30, too, but again as tagged ports (trunk ports) with PVID 10. Assign all EAPs static IPs from the 10.10.10.0 network, so they can communicate with OC200. Set management VLAN of all EAPs to VLAN 10. Requirement #4 met.¹
- Assign the three SSIDs their VLAN IDs 10, 20 and 30 respectively. SSID "Office" is 10, "Student" is 20, "Rooms" is 30. Requirement #5 fulfilled.
- Create a forwarding rule in your router from networks/VLANs 20 and 30 into network/VLAN 10 (they are in different firewall zones). Define the OC200's IP address as exception in OC200 ACL default block rule for private IPs, assign this ACL to the three SSIDs (see Advanced Wireless Settings). Requirement #6 fulfilled.
¹ Be aware that connection to the OC200/EAP temporarily will fail when applying the change of the mgmt VLAN if you are not inside VLAN 10 while setting this up.
That's all.
Management traffic from EAPs will use VLAN 10, Office LAN.
Wireless clients use VLAN 10, 20 and 30 depending on the SSID they are connected to. IPs for wireless and wired clients will be assigned by a DHCP server which must maintain 3 pools for the 10.10.10.0, 10.10.20.0 and 10.10.30.0 networks.
Traffic from clients in any network can reach the OC200 for portal page via Inter-VLAN routing (forwarding) on the router.
PS: Please avoid double postings of the same question in different threads.
That's even better (a separated management network for OC200: VLAN 200).
But why then VID: 1? Port to OC200 must be an untagged member of VLAN 200 and needs to have PVID 200 to make it work.
No. Ports for EAPs with VLANs 10, 20, 30 and 200 must be all tagged (trunk ports). No untagged traffic to EAPs, this will not work with VLAN-aware Multi-SSIDs! Only OC200 needs to transmit untagged (management) traffic.
Of course, if you want to distribute a single VLAN, say 10, only to an EAP group (say, the two in Office space) you need to assign those EAP's ports only membership of VLAN 10 and 200, both tagged, but not VLAN 20 and 30. The port's PVID should be 200 then. But I think it's better to feed them all VLANs and enable/disable the SSID-VLAN per EAP where needed.
This is the topology:
Make a diagram to make me understand.
concept: any eap in any subnet has to emit all ranges of wifi.
I think the problem may be in firewall or ports of the RB3011.
When I set up any EAP on the ETH8 port of RB3011 it worked, then remove it and place it in another range it worked too, but OC200 stopped seeing it. But all the configured Wi-Fi worked correctly in a Wi-Fi test.
If OC200 is able to function in that way, I am obviously doing something wrong. I hope you understand that I am not an expert in networks.
Stop using "managment Vlan 200" on oc200.
I think that if I could have an option in each EAP, which says that VLAN is going to work, it would be easier for me.
thks for your time.
