Juniper AX411 - Figure 9: Radius-Based VLAN Assignment

20 Copyright © 2011, Juniper Networks, Inc.
APPLICATION NOTE - Configuring and Deploying the AX411 Wireless Access Point
Figure 9: RADIUS-based VLAN assignment
INTERNET
OFFICE
ge-0/0/7.0 (trust)
192.198.254.1/24
Radius Server
192.168.254.2
Client
AP-1
00:de:ad:10:75:00
AP-2
00:de:ad:10:76:00
AP-3
00:de:ad:10:77:00
Radius Server
It authenticates the user and returns
the VLAN tag used for that client
VLAN
Each VLAN is mapped to a dierent zone
and has dierent access priviledges
CorpNet SSID
A single SSID is transmitted by both radios.
Clients are assigned to a dierent
VLAN by the radius server
SRX
Series
ge-0/0/0.0
(untrust)
198.0.0.1/24
set interfaces interface-range APs member ge-0/0/1
set interfaces interface-range APs member-range fe-0/0/2 to fe-0/0/3
set interfaces interface-range APs unit 0 family ethernet-switching port-mode
trunk
set interfaces interface-range APs unit 0 family ethernet-switching vlan members
default
set interfaces interface-range APs unit 0 family ethernet-switching vlan members
WiNet
set interfaces interface-range APs unit 0 family ethernet-switching vlan members
GuestNet
set interfaces interface-range APs unit 0 family ethernet-switching native-vlan-
id default
set interfaces vlan unit 1 family inet address 192.168.2.1/24
set interfaces vlan unit 2 family inet address 192.168.2.1/24
set interfaces vlan unit 3 family inet address 192.168.3.1/24
set wlan access-point AP-1 mac-address 00:12:cf:c5:4a:40
set wlan access-point AP-1 radio 1 virtual-access-point 0 ssid WiNet
set wlan access-point AP-1 radio 1 virtual-access-point 0 vlan 3
set wlan access-point AP-1 radio 1 virtual-access-point 0 security dot1x radius-
server 192.168.254.2
set wlan access-point AP-1 radio 1 virtual-access-point 0 security dot1x radius-
key juniper
set wlan access-point AP-1 radio 2 virtual-access-point 0 ssid WiNet
set wlan access-point AP-1 radio 2 virtual-access-point 0 vlan 3
set wlan access-point AP-1 radio 2 virtual-access-point 0 security dot1x radius-
server 192.168.254.2
set wlan access-point AP-1 radio 2 virtual-access-point 0 security dot1x radius-
key juniper
By default, users will be placed in vlan 3 (GuestNet), unless the RADIUS server assigns the VLAN ID 2, in which case the
user will access the WifiNet.