One SSID, One VLan, One IP Pool, Restrict Access by Role


We have a requirement here.
Situation as below.

One SSID, One Vlan, One IP Pool.
Differentiate by Roles such as Role A can access between Role A, internet and internal.
Role B can only access to Internet and between Role B, means no internal.

Is there a way to do this?

Thanks.

12 replies

Userlevel 1
Hmm. Is there a reason you have to have one vlan and ip pool? If you were able to break from that you could use NPS like this. https://community.extremenetworks.com/extreme/topics/one-ssid-redirect-to-two-different-vlans Outside of that... I'd say you'd have to implement 802.1x and maybe use NAP. https://technet.microsoft.com/en-us/network/bb545879.aspx Anything more specific let me know. Good luck!!
Christopher Davis wrote:

Hmm. Is there a reason you have to have one vlan and ip pool? If you were able to break from that you could use NPS like this. https://community.extremenetworks.com/extreme/topics/one-ssid-redirect-to-two-different-vlans Outside of that... I'd say you'd have to implement 802.1x and maybe use NAP. https://technet.microsoft.com/en-us/network/bb545879.aspx Anything more specific let me know. Good luck!!

It's a coworking place and management wants it to be clean and easy.
Therefore, they wish to have only one ssid and single ip pool.
Wanted to do it using Extreme solutions like IdentiFI, NAC, Purview
Userlevel 1
Christopher Davis wrote:

Hmm. Is there a reason you have to have one vlan and ip pool? If you were able to break from that you could use NPS like this. https://community.extremenetworks.com/extreme/topics/one-ssid-redirect-to-two-different-vlans Outside of that... I'd say you'd have to implement 802.1x and maybe use NAP. https://technet.microsoft.com/en-us/network/bb545879.aspx Anything more specific let me know. Good luck!!

Understandable, although it'd be an easier solution to manage without this. NAC is a solution. Well, IAC anyway. http://learn.extremenetworks.com/rs/641-VMV-602/images/Identity-and-Access-Control-DS.pdf This should be what you're looking for.
Christopher Davis wrote:

Hmm. Is there a reason you have to have one vlan and ip pool? If you were able to break from that you could use NPS like this. https://community.extremenetworks.com/extreme/topics/one-ssid-redirect-to-two-different-vlans Outside of that... I'd say you'd have to implement 802.1x and maybe use NAP. https://technet.microsoft.com/en-us/network/bb545879.aspx Anything more specific let me know. Good luck!!

Sorry of misunderstood, so NAC is called IAC now.
How do I use this to achieve the objective.
@Christopher Davis

It's a coworking place and management wants it to be clean and easy.
Therefore, they wish to have only one ssid and single ip pool.
Wanted to do it using Extreme solutions like IdentiFI, NAC, Purview.
Userlevel 4
The Keyword to this is "OnePolicy" . Based on the role the Client get's his own policy and can access exactly the targets you want. The only things you need are a wireless controller, several APs and a radius server. When you use Extreme Control (formerly NetSight and NAC), you can do this very easily.

/André
André Herkenrath wrote:

The Keyword to this is "OnePolicy" . Based on the role the Client get's his own policy and can access exactly the targets you want. The only things you need are a wireless controller, several APs and a radius server. When you use Extreme Control (formerly NetSight and NAC), you can do this very easily.

/André

Is there any configuration example I could study on?
Helps me to understand faster as I haven't configured any policy yet.

Also, it could configured in OneView Policy sector right?
Userlevel 6
Hello, Jaden!

I think simples way is to use authenticate roles based on MAC addresses of clients.
Like Role A - accept all for MAC addresses A, B, C.
Role B - (for example) deny dns, deny Internet gateway for MAC addresses D, E, F.

Thank you!
Alexandr P wrote:

Hello, Jaden!

I think simples way is to use authenticate roles based on MAC addresses of clients.
Like Role A - accept all for MAC addresses A, B, C.
Role B - (for example) deny dns, deny Internet gateway for MAC addresses D, E, F.

Thank you!

It's impossible to authenticate with MAC addresses as there will be Role B,C,D and so on.
Tenant may come and go, this will be bulky of work.
Userlevel 6
Alexandr P wrote:

Hello, Jaden!

I think simples way is to use authenticate roles based on MAC addresses of clients.
Like Role A - accept all for MAC addresses A, B, C.
Role B - (for example) deny dns, deny Internet gateway for MAC addresses D, E, F.

Thank you!

So, in this case you have to use RADIUS/TACACS+, NAC and so on.
(to have some condition on which map some role)

Thank you!
Userlevel 6
It is easy to accomplish that with EXtreme Control solution = NAC. In the management you will define criteria like MAC address or Username or hostname and based on that you assign the right profile. In the profile you define ACLs what such device/user can do... Single SSID design is good. Good luck.
Pala, Zdenek wrote:

It is easy to accomplish that with EXtreme Control solution = NAC. In the management you will define criteria like MAC address or Username or hostname and based on that you assign the right profile. In the profile you define ACLs what such device/user can do... Single SSID design is good. Good luck.

Any documentation can I refer to?
I would like to use with the Radius server too.
Userlevel 3
Pala, Zdenek wrote:

It is easy to accomplish that with EXtreme Control solution = NAC. In the management you will define criteria like MAC address or Username or hostname and based on that you assign the right profile. In the profile you define ACLs what such device/user can do... Single SSID design is good. Good luck.

If you have Radius-LDAP you can define de field Filter-ID attribute at the radius response, and create a rol with the same name at the Role tab.
In the VirtualNetwork tab you configure the default role, but if the radius response can find a role with the same name that the Filter-ID attribute then role asigned change.
I am not sure at all, but you can create a testing wlan

Reply