Expired

III. Wireless LAN

Expired

Central AP Management Setup Example - Office WiFi with Guest network

Products:

Show all

Keywords:

Show all

Many organisations offer access to the internet for their staff. This may be for business reasons, allowing the user to operate and carry out company functions. There may also be a requirement to allow access to the internet for people who visit the company. As visitors are guests to the organisation, they are usually restricted and cannot access any of the company’s resources such as printers or stored files. This keeps the organisation's internal network private from the visitor and helps to maintain security. This is achieved by creating a separate wireless network which is isolated from the main network, in effect setting up multiple SSIDs which can’t access each other.

This setup guide demonstrates how to use the Central AP Management feature in combination with the router's VLAN facility to create a wireless network for both internal and guest users, on multiple VigorAP Access Points through the DrayTek Vigor router.

This guide is written for firmware versions 3.8.4.x and later firmware, the features shown may not be present or may behave differently with prior firmware versions.

Managing VigorAP Access Points with a DrayTek Vigor Router

The Central AP Management facility available on DrayTek Vigor routers, allows the router to control multiple access points (number varies by model, check product specification) for configuration, monitoring and management such as firmware upgrades.

With Central AP Management, a single profile can be applied to a group of VigorAP Access Points, greatly reducing the time required to configure a number of access points on a network.

VLAN Configuration - The changes required on the Vigor router to separate the Internal network from the new Guest network

Central AP Management - Configure a number of VigorAP Access Points through a single profile

VLAN Configuration
Central AP Management

VLAN Configuration

The VigorAP Access Points on the network must be connected to the router with a wired network connection to use VLAN tags required for a guest wireless network; wireless links such as WDS or Universal Repeater cannot pass VLAN tags that are required for a guest wireless network to operate.

Network Configuration

Network Segment	Network	VLAN Name	VLAN Tag	IP Range
Internal Network	LAN1	VLAN0	Untagged	192.168.1.0 / 24
Guest Network	LAN2	VLAN1	10	192.168.2.0 / 24

The wireless guest network is configured as a separate network on the DrayTek router using a VLAN tag of "10". This VLAN tag is not used by the internal network so the existing network setup will not be affected. The VigorAP Access Point's guest wireless network SSID would be configured to tag traffic on that SSID with the VLAN tag of "10", which would then be processed by the router as part of the guest network, keeping it separate from the internal network.

The VigorAP Access Point's management interface remains on the LAN1 subnet.

Configure VLANs on the DrayTek router

Access the DrayTek Vigor router's web interface and go to [LAN] > [VLAN] – on that page, tick Enable.

On the VLAN1 row, tick Enable in the VLAN Tag column and set the VID to 10, this means that any traffic received by the router with a VLAN tag of 10, will be assigned to the VLAN1 (Guest) network.

Tick the LAN Port VLAN settings as shown, with all LAN ports P1 to P6 being a member of both VLAN0 and VLAN1. This is to simplify the network configuration, any VigorAP will need to have access to the Internal (untagged) and Guest (VLAN tag 10) network segments; making each port a member of both VLANs effectively makes it operate as a "Trunk" port. The VigorAPs can then be connected to the router directly or through a switch.

If the router is a wireless model, make sure that the SSID entries are each a member of a VLAN, as shown below, otherwise the router will not be able to save the setting changes.

Note - Network Configuration

If the VigorAP access points are connected to the router through a network switch, check whether the switch is Managed or Unmanaged.
An Unmanaged switch will typically be able to pass tagged and untagged packets with no configuration required.

A Managed switch may have default VLAN configuration settings that could cause the switch to drop packets with VLAN tags. It may be necessary to reconfigure the switch to pass through untagged and VLAN tagged packets. Check the managed switch's documentation for information. There are no specific settings recommended in this guide because of variation in usage of terms between manufacturers.

You may have noticed that P1,P2,P3,P4,P5,P6 are in both LAN1 and LAN2. The LAN that the router places traffic in depends on the tag received. If it recevies as a packet that has ID 10 then it treats it as LAN 2 and if it receives packets without a tag then it would treat it as LAN 1. For example if a simple PC is connected it wouldn't have the VID 10 tag and so would be allocated DHCP from LAN 1.

Click OK to apply the new VLAN configuration.

The router will prompt with this message if LAN2 / VLAN1 has not been configured previously:

The tickbox shown for "LAN 2" will enable the LAN2 subnet with it default IP settings of:

IP Address	192.168.2.1
Subnet Mask	255.255.255.0
DHCP Range	192.168.2.10 to 192.168.2.110

Clicking OK on this warning page will reboot the router to apply the setting changes.

If the LAN 2 IP settings need to be changed, they can be configured in the [LAN] > [General Setup] section once the router has restarted.

When the router has restarted, access the web interface and go to [LAN] > [General Setup].

This has the different LAN interfaces listed for the router, with the Inter-LAN Routing Table below it; which controls whether LAN interfaces can access each-other:

In this example, the Guest network which will use the LAN 2 interface, should not have access to the Internal / LAN 1 network, therefore the tickbox for LAN 2 to access LAN 1 is not checked in the Inter-LAN Routing table.

In instances where communication should be allowed between the networks connecting through the router's multiple LAN interfaces, tick the check box in the Inter-LAN Routing table and click OK to apply the change.

Central AP Management

Configuring VigorAP Access Points through a DrayTek Vigor Router

DrayTek VigorAP Access Points connected to the local network of a DrayTek Vigor router will detect automatically.

The VigorAP Access Points detected by the router are displayed in [Central Management] > [AP] > [Status]:

This displays the current settings of an access point with its primary SSID on the 2.4GHz and 5GHz interfaces, wireless channels used and the number of wireless clients connected.

Clicking on the Index number for an access point in this list will show additional details on the configuration of the access point.

To begin setting up the VigorAP Access Points, go to [Central Management] > [AP] > [WLAN Profile], which contains the profiles configured on the DrayTek Vigor router for use with VigorAP Access Points.

The "Default" profile will not be used in this example.

Click the check-box for an available profile and click Edit to continue:

Each wireless profile has three pages:

Wireless Interface & Device Settings
2.4GHz SSID & Security Settings
5GHz SSID & Security Settings

On the first page of the profile, the following settings can be configured. A description of each setting is listed in the table below.

Option	Setting	Description
Device Settings
Profile Name	Office Wireless	An identifier for the profile. This is only used by the router and does not appear on VigorAPs
Administrator	admin	The username applied onto the VigorAP for management
Password	set a secure password	The password applied onto the VigorAP for management
2.4GHz / 5GHz WLAN General Settings
Wireless LAN	Enable	Enable or Disable the wireless interface
Limit Client	Off	Limit the number of clients to the specified amount
Operation Mode	AP	Access Point or Universal Repeater mode
2.4G / 5G Mode	Mixed	Sets the allowed 802.11 types that can connect to the AP
2.4G / 5G Channel	6 & 48	The wireless channel that the AP will operate on
Airtime Fairness	Disable	Enable or Disable Airtime Fairness
Band Steering	Enable	2.4GHz Only - guides dual band wireless clients to 5GHz band
Roaming	Disable	Requires WPA2/802.1X security, enables Fast Handoff
WMM	Disable	Enable or Disable Wireless Multi Media
Tx Power	100%	Control TX Power of VigorAP's wireless radio

With the settings configured, click the Next button to continue which will prompt for the 2.4GHz SSID and Security settings.

There are additional settings further down the page for configuring Access Control Lists and Bandwidth Management settings, these are not essential for the setup of a wireless network and will not be covered in this guide.

Configure SSID1:

Option	Setting
SSID (wireless network name that will be broadcast)	Office WiFi
VLAN	0
Encryption	WPA2/PSK
WPA Algorithm	AES
WPA Pass Phrase (password)	set a secure password
WPA Key Renewal Interval	3600

Click on SSID2 to configure the Guest wireless network on the 2.4GHz interface:

Option	Setting
SSID (wireless network name that will be broadcast)	Guests
VLAN	10
Encryption	WPA2/PSK
WPA Algorithm	AES
WPA Pass Phrase (password)	set a secure password
WPA Key Renewal Interval	3600

With the 2.4GHz settings configured, click the Next button to configure the 5GHz SSID & Security settings. These are configured with the same settings as the 2.4GHz interface:

Option	SSID 1 Setting	SSID 2 Setting
SSID (wireless network name that will be broadcast)	Office WiFi	Guests
VLAN	0	10
Encryption	WPA2/PSK	WPA2/PSK
WPA Algorithm	AES	AES
WPA Pass Phrase (password)	set a secure password	set a secure password
WPA Key Renewal Interval	3600	3600

Click Finish to complete the WLAN Profile configuration, which will return to the list of profiles:

Click the check-box for the profile to apply and click Apply To Device. This will pop-up a window to select which VigorAP Access Points to apply the profile to. Select the access points from the left and click [>>] for each VigorAP that will have the profile applied, then click OK. The router will then apply the WLAN Profile to the Access Points.

Once the configuration has been applied, each VigorAP Access Point will restart with the new configuration. This should be visible after roughly a minute in the [Central Management] > [AP] > [Status] section, with the new SSID settings visible:

Click on an Index number for one of the VigorAP Access Points to view the list of settings:

The wireless network will now be ready for use, with the "Guests" network able to access the Internet without any access to internal network resources.

How do you rate this article?

1 1 1 1 1 1 1 1 1 1

: First Published: 01/02/2017; Last Updated: 22/04/2021

Share this link