Dynamic Vlan Assignment Microsoft Nps 2012

We currently are using UniFi AP's with controller 5.3.8.2. Is it possible to have Microsoft 2012 R2 NPS Server assign Dynmica LAN's to clients that.

Best practice in terms of the number of SSIDs you should have available from your wireless network is generally accepted to be around 4 or 5 SSIDs a s a maximum. The main reason for this is that each SSID is constantly broadcasting 10 beacons per second, which obviously multiplies up fairly quickly as you add more SSIDs. As WiFi networks are a contended medium (i.e. Only one client or AP may use a channel at any point in time), then your available airtime can get eaten up by beacons and cripple the throughput of your wireless network. The answer is to use the same SSID multiple times for multiple services, by assigning users to a designated VLAN based on their level of authorization on the network.

Looking at a simple example, lets consider a school that wishes to use the same SSID for both students and staff. Students may be allowed access to a particular set of systems (e.g. The school learning system portal and the Internet). Staff may be more privileged and allowed access to a wider set of systems (e.g. Bank Of America Online.

Learning portal, staff administration systems and Internet). The restrictions on each group of user's access can be enforced by assigning the users to a VLAN that has appropriate access restrictions (e.g. VLANs may have ACLs applied or firewall rules that only allow traffic on those VLANs to access particular systems). With Microsoft NPS, it is possible to decide if a user belongs to a particular group of AD users (e.g. Staff or students) and make an initial decision about allowing them access to the network. However, in addition, it may also pass back information about which VLAN users in each group are allowed to access.

Using this approach, you can begin to see how NPS can be used to allow users on an SSID to be authenticated to the wireless network, but only allowed access to authorized resources by assigning them to an appropriate VLAN (based on their AD group membership). As we've already discussed, this provides great benefits in reducing additional overheads associated with multiple SSIDs on a WiFi network. In addition, it simplifies user wireless management by allowing all users to be configured with a single wireless client profile, with their access being configured via Microsoft AD. One caveat to note when trying to use this technique is that all users must be using the same security mechanisms to join the SSID. For instance, all users must be using 802.1x (EAP) - you can't have a mix of PSK & 802.1x authenticated devices on the same SSID. Generally, they should also be using the same WPA version (i.e.

Trittico Botticelliano Program Notes Randall. WPA or WPA2).