Configure Multiple SSIDs on a Network
Objective
The Service Set Identifier (SSID) is a unique identifier that wireless clients can connect to or
share among all devices in a wireless network. It is case-sensitive and must not exceed 32
alphanumeric characters.
The objective of this article is to show you how to properly configure multiple SSIDs on a
network using VLANs to properly segment the private and guest network.
Why would you configure multiple SSIDs?
In a fast-changing and growing work environment, a network needs to be scalable to fit the
needs of the company. That would include virtual and physical changes for the most cost-
effective methods.
In environments where people come and go such as coffee shops or co-working spaces, it is
best practice to segment networks. Create a shared network for the employees where
sensitive, corporate data can be exchanged (private network) and another one for the
transient workers or customers (guest network).
Note: A captive portal can also be created as a means of additional security for a public
network. Captive Portal is a feature on your Wireless Access Point that allows you to set up
a guest network where wireless users need to be authenticated first before they can have
access to the Internet. It provides wireless access to your visitors while maintaining the
security of your internal network. To learn how to configure a Captive Portal, click here.
Network Topology
Advantages of using Multiple SSIDs:
1. Secure and persistent connectivity
2. Persistent security and policy enforcement
3. Maximizing network capability by segmenting public and private networks
4. With a public SSID, it grants access to the Internet for guests over the same WAP without
crossing over into sensitive network information.
Applicable Devices
● Router — RV340
● Switch — SG220-26P
● Wireless Access Point — WAP150
Software Version
● 1.0.01.17 — RV340
● 1.0.1.7 — WAP150
● 1.1.2.1 — SG220-26P
Configure a VLAN on a Switch
Create a VLAN for Private and Guest Network
Step 1. Login to the web-based utility of the switch and choose VLAN Management >
Create VLAN.
Step 2. In the VLAN table, click Add to create a new VLAN.
Step 3. In the VLAN ID field, assign a value for your VLAN. Range is 2-4094.
Note: The VLAN ID 25 will be the example used throughout the configuration.
Step 4. In the VLAN Name field, enter a name within the 32-character limit.
Note: In this example, GuestDisco is used.
Step 5. Click Apply.
Step 6. Repeat Steps 2 to 5 to create multiple SSIDs.
Note: In this example, a private VLAN network with SSID PrivateDisco has been additionally
created.
You should now have successfully created VLANs for both private and guest networks.
Assign a Port to a VLAN
Step 1. Choose VLAN Management > Port to VLAN.
Step 2. In the Filter area, from VLAN ID equals to drop-down list, choose a VLAN ID to
assign to an interface.
Note: In this example, 25 is chosen.
Step 3. In the Filter area, from the Interface type equals To drop-down list, choose the type
of interface you would like to add to the VLAN. The available options are either a port or a
Link Aggregation Group (LAG).
Note: In this example, Port is chosen.
Step 4. Click Go.
Step 5. Choose an interface to apply the VLAN to. The options are:
● Forbidden — The interface is not allowed to join the VLAN even from Generic VLAN
Registration Protocol (GVRP) registration. When a port is not a member of any other VLAN,
enabling this option on the port makes the port part of internal VLAN 4095 (a reserved VID).
● Excluded — The interface is currently not a member of the VLAN. This is the default for all the
ports and LAGs. The port can join the VLAN through GVRP registration.
● Tagged — The interface is a tagged member of the VLAN.
● Untagged — The interface is an untagged member of the VLAN. Frames of the VLAN are sent
untagged to the interface VLAN.
● PVID — Check to set the PVID of the interface to the VID of the VLAN. PVID is a per-port
setting.
Note: In this example, GE8 is the chosen interface for the VLAN ID 25 to be tagged. This is
also chosen because an existing WAP is connected through this port.
Step 6. Click Apply.
Step 7. (Optional) Click the Port VLAN Membership Table button to view the assigned
VLANs to a port.
You should now have successfully assigned a VLAN to a port.
Create a VLAN on a Router
Note: The router used in this example is an RV34x Series Router.
Step 1. Log in to the web-based utility of the router and choose LAN > VLAN Settings.
Step 2. In the VLAN Table, click Add to create a new VLAN.
Step 3. In the VLAN ID field, enter a number between 2-4094 to be the VLAN ID.
Note: In this example, the VLAN ID is 25. The VLAN name will automatically populate in
accordance to the entered VLAN ID.
Step 4. (Optional) Check the Enable Inter-VLAN Routing check box to allow communication
between different VLANs. This is checked by default.
Note: VLANs divide broadcast domains in a LAN environment. Whenever hosts in one
VLAN need to communicate with hosts in another VLAN, the traffic must be routed between
them.
Step 5. In the IPv4 Address field, enter an IPv4 address.
Note: In this example, 192.168.11.1 is used as the IPv4 address.
Step 6. Enter the prefix length for the IPv4 address in the Prefix Length field. This
determines the number of hosts in the subnetwork.
Note: In this example, 24 is used.
Step 7. Click Apply.
Step 8. Repeat the steps as necessary for the VLANs.
Note: In this example, an additional VLAN was created with VLAN ID 30.
You should now have successfully configured an IPv4-based VLAN on a router.
Configure a VLAN on a Wireless Access Point
This article assumes that the basic radio settings have been configured. To learn how to
configure the basic radio settings on a WAP, click here.
In this series of steps, we are modifying an existing network on a single radio on the
WAP150.
Step 1. Login to the web-based utility of the WAP and choose Wireless > Networks.
Step 2. Click a radio button to choose a radio band to create and broadcast a wireless
network. The options are:
● 2.4 GHz — Wider range, better for legacy devices that support only 2.4 GHz.
● 5 GHz — Provides a more secure coverage and provides better compatibility with newer
devices.
Note: In this example, Radio 2 (5 GHz) is chosen.
Step 3. In this step, you can opt to create or edit an SSID. Check the check box of the SSID
or Virtual Access Point (VAP) you want to edit.
Note: In this example, VAP 0, VAP 1, and VAP2 are chosen.
Step 4. Click Edit.
Step 5. Check the Enable check box to enable the SSID.
Note: In this example, the GuestDisco and Private Disco are checked.
Step 6. In the VLAN ID field, enter the recently configured VLAN ID that was configured on
both the router and switch.
Note: In this example, it would be 25 and 30.
Step 7. (Optional) In the SSID Name field, rename the existing SSID name.
Note: In this example, no changes were made.
Step 8. Check the Enable SSID Broadcast check box to enable visibility to your wireless
client devices.
Step 9. From the Security drop-down list, choose the type of security to enforce on the
network. The options are:
● None — This is the default setting. Choosing None will leave the wireless network unsecured
so anybody with a wireless client device can connect to the network easily.
● WPA Personal — Wi-Fi Protected Access (WPA) uses Advanced Encryption Standard (AES)
cipher to protect the wireless network. It uses a combination of case-sensitive letters and
numbers for the password. This security type is recommended.
● WPA Enterprise — WPA Enterprise is typically used in enterprise structured networks. It
requires a Remote Authentication Dial-In User Service (RADIUS) to complete this type of
wireless security setup.
Note: In this example, WPA Personal is applied to both SSIDs.
Step 10. Choose an option from the MAC Filtering drop-down list to assign an action to the
router to filter hosts according to their Media Access Control (MAC) address. The options
are:
● Disabled — MAC Filtering is disabled on the network.
● Local — Uses a list created on the WAP to filter MAC addresses from accessing the network.
● RADIUS — This option makes use of a RADIUS server to filter MAC addresses.
Step 11. Check the Channel Isolation check box to disable communication between clients.
Step 12. (Optional) Check the Band Steer check box to steer and direct devices to a more
optimal radio frequency, thus, improving network performance.
Step 13. Click .
Step 14. A window will pop up to inform you that your wireless settings are about to be
updated and that you may be disconnected. Click OK to continue.
You should now have successfully configured multiple SSIDs with the proper
VLANs/segmentation on an access point.
