Which AccessPoint would be recommended - Multiple or Single SSID

Gamienator 0

Hey everyone,

I want to seperate my home network into VLANs. The only thing that is preventing me to do that is my current AccessPoint (Which isn't VLAN aware) and one small switch in my living room.

Before I decide which AP I'm buying I wanted you to ask what is necessary to have a single SSID with different VLANs? On our Work we're on the way to establish that and I liked that Idea to have only one SSID for all. What I imagine is that the access policy can be a pain. Couple of my WiFi Devices only allow WPA2 with a pre shared key, is this still possible then.

What other components / software do I need on my pfSense or network to get this goal? Hardware wise I would like to have an AP that:

is VLAN aware (duh)
capable to me monitored via SNMP ( or other way to get CheckMK monitoring that)
WiFi 6 would be a plus
Mesh would be great if I need to expand the AP at one point

What are there the best practises?

Cheers!

keyser

@gamienator-0 It’s a great feature, and I use it here at home as well. The thing is, it can be done in more than one way, but generally to achieve what you are looking for, you need to add a level of authentication of clients connecting to the SSID - and the authentication server then returns which VLAN the client should be located on. The idea is that all non-registered clients (those who cannot authenticate) are relegated to the Guest VLAN.

Usually the authentication can be done via a built in database in the wireless system, or you can use an external authentication system (Radius). Since you are running pfSense i highly recommend the Freeradius3 package. That way all the users/devices you create that can pass authentication is in your pfSense config and can follow you through hardware upgrades.
Also - you can ad a wired switch and utilize the exact same authentication model/system to assign VLANs to the switchport depending on the user/device.

You need to make sure to buy a wireless setup that allows external radius authentication.

The cheap solution would be UniFi
The best solution would be Aruba Instant (NOT Instant On)

Both will do what you are looking for including Mesh.

NogBadTheBad

@gamienator-0 I use an Aruba InstantOn AP22 , they are cloud managed, quite cheap £140 in the UK and not Ubiquity

https://www.arubainstanton.com/products/access-points/access-point-22/

is VLAN aware (duh) Yes

Capable to me monitored via SNMP ( or other way to get CheckMK monitoring that) No

WiFi 6 would be a plus Yes

Mesh would be great if I need to expand the AP at one point Yes

"single SSID with different VLANs" Do you mean the same SSID on different VLANS, if you do that's not possible ?

Regarding the monitoring if you are after the down state the Aruba app can send you notifications.

Do you currently have VLANS on the switch?

keyser

@gamienator-0 Just as a follow up. The above reply is why I do not recommend Aruba “Instant ON” but rather the full Aruba Instant APs

They will do SNMP, and authentication to have one SSID cover all the VLANs you like.

And yes, you can do this on a WPA2 - PSK encrypted SSID. The PSK is the same for all clients, but their authentication decides which VLAN is used on the backend. You can authenticate just using the MAC address. This is the easy way, but not very secure (security by obscurity). You can do a layered approach and MAC authenticate less secure devices to less secure VLANs (if they do not support 802.1x), and then use 802.1x for the real secure devices on the really secured VLAN.

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

WiFi Devices only allow WPA2 with a pre shared key, is this still possible then.

Wanting to have just 1 ssid and assign clients to different vlan can be done - but if your clients can only use psk and not enterprise method you need to assign the vlan based on mac, or MAC Authentication Bypass (MAB)..

I did some playing with this on unifi few years back, and I was able to get a vlan assigned based on the clients mac, etc.

I thinking as well just use 1 ssid - but never did it, just not worth it to be honest.. Takes 2 seconds to setup different ssids on different vlans and use the appropriate auth for the what would be on that vlan.. There is no iot devices that are going to support any sort of enterprise auth.. So anything you want on any specific vlan would take much more effort in the setup and maintenance, and way more complex so more likely for issues to come up..

It is just easier to just create a SSID for your different vlans, then just connect to that ssid.. My trusted devices connect with eap-tls auth, etc. Ie they have a cert via wpa3 as well..

Also if running multiple ssids you can use say wpa3-enterprise on 1 for your trusted devices and put them on vlan X, while not so trusted devices and device not capable of enterprise auth you put on some wpa2-psk vlan Y..

Yes it would be slick to just have 1 ssid, and clients just auth and get place in appropriate vlan.. But then again what if user A wants to be on vlan X, but his login points him to vlan Y.. now he needs to auth as billy vs john with different passwords? Or have a completely different cert for his eap-tls auth? etc. etc..

As to which AP - been a fan and user of unifi for many years, have been happy with them.. But currently I have been looking at the tplink omada stuff for when I move to AX.. They are cheaper and fired up the controller software - 2 things jumped out at me as way ahead of unifi.. Simple ssl cert admin for the gui, setting the cert for just the web gui in the unifi controller is a PITA.. Something that has been asked about for years and years.. They do nothing, also unifi web gui only tls 1.2, while omada was 1.3 - I have looked and looked and asked on their forums about changing the web gui for unifi controller to 1.3 - freaking crickets..

So when it comes for me to update/replace my current APs - I will be looking other than unifi that is for sure, another thing that just pisses me off, the AP ssh is running a version of dropbear from 2020.. doesn't support current ciphers, etc. Not like there is not update available - not like they are not releasing new firmware for the AP every other week, etc.. Upgrade the basics on the AP, etc..

JKnott

I have a Unifi AC-Lite with a Guest SSID and it works fine. Normally, you have a SSID for each VLAN, up to whatever the AP supports.

SteveITS

@johnpoz said in Which AccessPoint would be recommended - Multiple or Single SSID:

It is just easier to just create a SSID for your different vlans, then just connect to that

Possibly a bit safer too? For instance if the AP dies then any old AP that supports VLANs can replace it. And/or a device can't connect to the right SSID and wrong VLAN.

@Gamienator-0 For a slightly different approach, eero has a guest SSID option that works in bridge mode, and prevents devices from connecting to the pfSense GUI or devices on LAN.

JKnott

@steveits

How many SSIDs is he planning on using? APs have a limit and the number isn't that high.

johnpoz

@jknott said in Which AccessPoint would be recommended - Multiple or Single SSID:

APs have a limit and the number isn't that high.

The unifi can do 8, and you could do different ones on the 2 different bands - so you in theory you could do 16.. I wouldn't recommend that ;)

The more ssids you have the more overhead and your channel utilization goes up.. And it gets worse the more APs you have all the SSIDs on..

keyser

@jknott said in Which AccessPoint would be recommended - Multiple or Single SSID:

@steveits

How many SSIDs is he planning on using? APs have a limit and the number isn't that high.

This is not the right approach. The overhead that multiple SSID’s bring causes a very steep dropoff in throughtput once you start going beyond 3 SSID’s (If you are looking at max bandwidth available). This is due to beaconing on each SSID at basic rates multiple times each second.

The OP is trying to build the optimal solution when it comes to performance and user friendliness.

Gamienator 0

Thank you all for your input! After some digging and searching I'm giving the TP-Link EAP670 a try. There is a multicast bug in the firmware that should be fixed in the current Beta Firmware, which would be great to enable IPv6 correctly

Currently I'm planning the VLANs I want to create and set it up next week. But for me it looks like it's possible to have only one SSID. It won't be perfect because it's MAC Adress based most likely, but this is better then tinkering with 3 SSIDs

At the end it's for my personal development as well and learn new things. I'm still curious how I'm able to make it possible for my DLNA Service in Plex and Serviio I guess a lot of swearing will happen

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

But for me it looks like it's possible to have only one SSID

EAP670

https://www.tp-link.com/us/business-networking/omada-sdn-access-point/eap670/#specifications
• Multiple SSIDs (Up to 16 SSIDs, 8 for each band)

Gamienator 0

@johnpoz Yes, it can do it as well in the standalone mode. But if you pair it with the controller you can have variable VLANs

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

But if you pair it with the controller you can have variable VLANs

Its not that it can't do them - its the administration, and limit of devices that can not send the auth to assign them.. Just trying to save you some headache.. iot devices do not support enterprise - And to be honest billy coming over his laptop or phone doesn't just auto use a different eap other then psk..

Dynamic vlans don't help you with dlna - if that what your thinking.

JKnott

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

There is a multicast bug in the firmware

That TP-Link multicast bug is still around? I had it in an AP I bought 11 years ago, which prevented me from running IPv6 on my guest WiFi. It also affected some switches. I recall when I tried to get it fixed, the support said it worked the way it was supposed to, but I eventually reached 2nd level support, who agreed it was a bug. There never was an update for mine, so I wound up getting a Unifi AC-Lite a couple of years ago.

Gamienator 0

@johnpoz thank you about that very much. I’m just really curious if I’m able to do that.

To separate my network was a long to do, cause I trust don’t trust a couple of my devices like my LED Controller, washing machine or TV. Since then I have to tinker with mDNS, Multicast anyway. One SSID for all is the cherry on the top. I don’t mind using PSK and with a MAC access list.

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

Since then I have to tinker with mDNS, Multicast anyway

And why is that? I have all my iot stuff in a IOT vlan - have to do zero with mdns or anything with multicast.. What exactly are you wanting to do that requires mdns or multicast - I love how people say they don't trust something and throw up a barrier, and then just break it anyway ;)

stephenw10

Mmm, for me using multiple SSIDs, one for each VLAN, is significantly simpler to setup and manage than trying to apply VLANs to clients based on auth or MAC.

johnpoz

@stephenw10 exactly - now if I had vlans for every dept and had like 20 dept or something in an enterprise - for sure would use 802.1x and dynamic vlans etc..

But for iot, or washing machine, tV - just throw them in iot SSID vlan and there you go.. If you don't want them talking to each for example just use a AP/Client isolation on your AP, or if wired private vlans on your switch, etc.

Gamienator 0

@johnpoz said in Which AccessPoint would be recommended - Multiple or Single SSID:

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

Since then I have to tinker with mDNS, Multicast anyway

And why is that? I have all my iot stuff in a IOT vlan - have to do zero with mdns or anything with multicast..

Well I still want to use them, for example on my TV, there is a DLNA Client. For that I want him to see my NAS, but only that for example. And AFAIK I need to Setup proper multicast forwarding.