4 ms·

Does anyone make an AP that allows unlimited (or at least a lot) of SSID's tied to separate VLANs? My Unifi's only support 4, so I have my private network (for

Does anyone make an AP that allows unlimited (or at least a lot) of SSID's tied to separate VLANs? My Unifi's only support 4, so I have my private network (for my own laptops, etc), guest network, camera network and IoT network. But I'd love to be able to separate IoT devices across multiple networks, so I could have one for smart switches, one for TV/media players, etc.

rand49an 5y ago
All enterprise gear should allow you to have multiple SSIDs on different or dynamic VLANs. You won't have that issue on Meraki, Ruckus, Cisco or Aruba gear. It's worth noting though that more than 3 SSIDs brings with it radio overhead which can degrade performance of your wireless network.
- Johnny555 5y ago
  I'm fine with losing Wifi performance if I can improve my home network security. When I'm sitting at my desk, my laptop is hardwired, and my only 4K TV is hardwired, so I don't have any great bandwidth needs, and even with 4 SSID's broadcast, I'm maxing out my 500mbit internet connection, so I even if I lost half that to overhead, I'd be ok with that. I've also thought about just setting up multiple nodes, one set for secure devices, one for insecure devices. Cisco "only" supports 16 SSID's, which is probably more than I'd even need.
EvanAnderson 5y ago
You don't want "unlimited" SSIDs-- you want a RADIUS-assigned VLAN and a single SSID. The credentials used to associate determine which VLAN the traffic dumps into. Your UniFi gear will do it. Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons).
- Johnny555 5y ago
  Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons) Yes, that's why I want more SSID's. My internal network does use 802.1x, but as you said, few devices outside of laptops support it.
- egberts1 5y ago
  You probably shouldn’t deploy an one-SSID model for your home network. Not many kernel can separate traffic within a single SSID (even if you did use VLAN, tcpdump on a malicious IoT can still view the traffic. Better to have four to seven SSID, each mapped to a subnet. Make one subnet/SSID for encrypted MAC with laptops. Cable TV, Smart TV, power-line LAN adapters, smart lightbulbs and webcams should go on separate SSID/subnet.
  - megous 5y ago
    Or just one SSID, where you directly put all the Androids, iPhones, IoTs, and similar garbage in addition to your trusted devices connected via a overlay wireguard network on top in full mesh configuration. You will not have to trust the potentially outdated wifi firmware, that is quite likely vulnerable to all the latest holes in wifi security.
  - privacyking 5y ago
    Wait so does enterprise wifi just send all VLAN traffic to every device despite a login being assigned to a single VLAN?
superbaconman 5y ago
Yeah this is what I'd like. I don't think I'd ever feel comfortable putting these shady devices on the same LAN as my PCs.
pyther24 5y ago
The Aruba Instant-On AP22 might do the trick. It uses the same hardware as the Aruba AP-505 which support 16 BSSIDS. I couldn't find a documented limit for the AP22. Note, the instant-on series uses a cloud controller and can't be managed locally, however it is a fraction of the price, $180 (Instant On AP22) vs $460 (AP-505).
second--shift 5y ago
Mikrotik. I have 5 'virtual' APs broadcasting wifi links for 5 different vlans / subnets.

rand49an 5y ago

All enterprise gear should allow you to have multiple SSIDs on different or dynamic VLANs. You won't have that issue on Meraki, Ruckus, Cisco or Aruba gear. It's worth noting though that more than 3 SSIDs brings with it radio overhead which can degrade performance of your wireless network.

Johnny555 5y ago
I'm fine with losing Wifi performance if I can improve my home network security. When I'm sitting at my desk, my laptop is hardwired, and my only 4K TV is hardwired, so I don't have any great bandwidth needs, and even with 4 SSID's broadcast, I'm maxing out my 500mbit internet connection, so I even if I lost half that to overhead, I'd be ok with that. I've also thought about just setting up multiple nodes, one set for secure devices, one for insecure devices. Cisco "only" supports 16 SSID's, which is probably more than I'd even need.

EvanAnderson 5y ago

You don't want "unlimited" SSIDs-- you want a RADIUS-assigned VLAN and a single SSID. The credentials used to associate determine which VLAN the traffic dumps into. Your UniFi gear will do it. Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons).

Johnny555 5y ago
Of course, a lot of consumer-grade hardware won't do 802.1x so you end up stuck with needing a bunch of SSIDs (and wasting air-time on beacons) Yes, that's why I want more SSID's. My internal network does use 802.1x, but as you said, few devices outside of laptops support it.
egberts1 5y ago
You probably shouldn’t deploy an one-SSID model for your home network. Not many kernel can separate traffic within a single SSID (even if you did use VLAN, tcpdump on a malicious IoT can still view the traffic. Better to have four to seven SSID, each mapped to a subnet. Make one subnet/SSID for encrypted MAC with laptops. Cable TV, Smart TV, power-line LAN adapters, smart lightbulbs and webcams should go on separate SSID/subnet.
- megous 5y ago
  Or just one SSID, where you directly put all the Androids, iPhones, IoTs, and similar garbage in addition to your trusted devices connected via a overlay wireguard network on top in full mesh configuration. You will not have to trust the potentially outdated wifi firmware, that is quite likely vulnerable to all the latest holes in wifi security.
- privacyking 5y ago
  Wait so does enterprise wifi just send all VLAN traffic to every device despite a login being assigned to a single VLAN?

superbaconman 5y ago

Yeah this is what I'd like. I don't think I'd ever feel comfortable putting these shady devices on the same LAN as my PCs.

pyther24 5y ago

The Aruba Instant-On AP22 might do the trick. It uses the same hardware as the Aruba AP-505 which support 16 BSSIDS. I couldn't find a documented limit for the AP22. Note, the instant-on series uses a cloud controller and can't be managed locally, however it is a fraction of the price, $180 (Instant On AP22) vs $460 (AP-505).

second--shift 5y ago

Mikrotik. I have 5 'virtual' APs broadcasting wifi links for 5 different vlans / subnets.