Which AccessPoint would be recommended - Multiple or Single SSID

JKnott

I have a Unifi AC-Lite with a Guest SSID and it works fine. Normally, you have a SSID for each VLAN, up to whatever the AP supports.

SteveITS

@johnpoz said in Which AccessPoint would be recommended - Multiple or Single SSID:

It is just easier to just create a SSID for your different vlans, then just connect to that

Possibly a bit safer too? For instance if the AP dies then any old AP that supports VLANs can replace it. And/or a device can't connect to the right SSID and wrong VLAN.

@Gamienator-0 For a slightly different approach, eero has a guest SSID option that works in bridge mode, and prevents devices from connecting to the pfSense GUI or devices on LAN.

JKnott

@steveits

How many SSIDs is he planning on using? APs have a limit and the number isn't that high.

johnpoz

@jknott said in Which AccessPoint would be recommended - Multiple or Single SSID:

APs have a limit and the number isn't that high.

The unifi can do 8, and you could do different ones on the 2 different bands - so you in theory you could do 16.. I wouldn't recommend that ;)

The more ssids you have the more overhead and your channel utilization goes up.. And it gets worse the more APs you have all the SSIDs on..

keyser

@jknott said in Which AccessPoint would be recommended - Multiple or Single SSID:

@steveits

How many SSIDs is he planning on using? APs have a limit and the number isn't that high.

This is not the right approach. The overhead that multiple SSID’s bring causes a very steep dropoff in throughtput once you start going beyond 3 SSID’s (If you are looking at max bandwidth available). This is due to beaconing on each SSID at basic rates multiple times each second.

The OP is trying to build the optimal solution when it comes to performance and user friendliness.

Gamienator 0

Thank you all for your input! After some digging and searching I'm giving the TP-Link EAP670 a try. There is a multicast bug in the firmware that should be fixed in the current Beta Firmware, which would be great to enable IPv6 correctly

Currently I'm planning the VLANs I want to create and set it up next week. But for me it looks like it's possible to have only one SSID. It won't be perfect because it's MAC Adress based most likely, but this is better then tinkering with 3 SSIDs

At the end it's for my personal development as well and learn new things. I'm still curious how I'm able to make it possible for my DLNA Service in Plex and Serviio I guess a lot of swearing will happen

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

But for me it looks like it's possible to have only one SSID

EAP670

https://www.tp-link.com/us/business-networking/omada-sdn-access-point/eap670/#specifications
• Multiple SSIDs (Up to 16 SSIDs, 8 for each band)

Gamienator 0

@johnpoz Yes, it can do it as well in the standalone mode. But if you pair it with the controller you can have variable VLANs

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

But if you pair it with the controller you can have variable VLANs

Its not that it can't do them - its the administration, and limit of devices that can not send the auth to assign them.. Just trying to save you some headache.. iot devices do not support enterprise - And to be honest billy coming over his laptop or phone doesn't just auto use a different eap other then psk..

Dynamic vlans don't help you with dlna - if that what your thinking.

JKnott

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

There is a multicast bug in the firmware

That TP-Link multicast bug is still around? I had it in an AP I bought 11 years ago, which prevented me from running IPv6 on my guest WiFi. It also affected some switches. I recall when I tried to get it fixed, the support said it worked the way it was supposed to, but I eventually reached 2nd level support, who agreed it was a bug. There never was an update for mine, so I wound up getting a Unifi AC-Lite a couple of years ago.

Gamienator 0

@johnpoz thank you about that very much. I’m just really curious if I’m able to do that.

To separate my network was a long to do, cause I trust don’t trust a couple of my devices like my LED Controller, washing machine or TV. Since then I have to tinker with mDNS, Multicast anyway. One SSID for all is the cherry on the top. I don’t mind using PSK and with a MAC access list.

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

Since then I have to tinker with mDNS, Multicast anyway

And why is that? I have all my iot stuff in a IOT vlan - have to do zero with mdns or anything with multicast.. What exactly are you wanting to do that requires mdns or multicast - I love how people say they don't trust something and throw up a barrier, and then just break it anyway ;)

stephenw10

Mmm, for me using multiple SSIDs, one for each VLAN, is significantly simpler to setup and manage than trying to apply VLANs to clients based on auth or MAC.

johnpoz

@stephenw10 exactly - now if I had vlans for every dept and had like 20 dept or something in an enterprise - for sure would use 802.1x and dynamic vlans etc..

But for iot, or washing machine, tV - just throw them in iot SSID vlan and there you go.. If you don't want them talking to each for example just use a AP/Client isolation on your AP, or if wired private vlans on your switch, etc.

Gamienator 0

@johnpoz said in Which AccessPoint would be recommended - Multiple or Single SSID:

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

Since then I have to tinker with mDNS, Multicast anyway

And why is that? I have all my iot stuff in a IOT vlan - have to do zero with mdns or anything with multicast..

Well I still want to use them, for example on my TV, there is a DLNA Client. For that I want him to see my NAS, but only that for example. And AFAIK I need to Setup proper multicast forwarding.

johnpoz

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

for example on my TV, there is a DLNA Client

For what service - while DLNA makes it easy for grandma - if you know what its wanting to talk to, say plex server or something - just allow that port through your firewall.. Jumping through hoops and punching discovery/multicast holes in your network security because you don't want to open 1 port from a specific client to a specific destination is a going the wrong direction from a security point of view with firewalling and segmentation of your network if you ask me.

If X needs to discover Y to work - I wouldn't trust either of them and would put them on the same network.

keyser

@jknott said in Which AccessPoint would be recommended - Multiple or Single SSID:

@gamienator-0 said in Which AccessPoint would be recommended - Multiple or Single SSID:

There is a multicast bug in the firmware

That TP-Link multicast bug is still around? I had it in an AP I bought 11 years ago, which prevented me from running IPv6 on my guest WiFi. It also affected some switches. I recall when I tried to get it fixed, the support said it worked the way it was supposed to, but I eventually reached 2nd level support, who agreed it was a bug. There never was an update for mine, so I wound up getting a Unifi AC-Lite a couple of years ago.

This is exactly why you should stay away from tp-link, linksys, d-link and the likes.
Firmware updates are scarce - if they even exist.