Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Ask Slashdot: How Do You Deploy Small Office Wi-Fi SSIDs?

timothy posted about a year and a half ago | from the call-them-all-linksys-done dept.

Networking 172

First time accepted submitter junkfish writes "I am not able to install a controller based Wi-Fi solution in my office due to cost, but I like presenting my users with a single SSID rather than an array of four or five differently named SSIDs from different access points. What is your experience deploying multiple wireless access points with the same SSID and password? I have been doing this with Cisco 1040 series Access Points this year, and have had good success. It seems like the client is able to determine which AP is best to connect to, and is able to roam around the office without too much of an interruption when it connects to a different AP. Is this sloppy practice? Or does the general state of the 802.11 provide for this sort of resiliency? I am really interested in your opinion because I have not seem too much documented on this subject."

cancel ×

172 comments

I've seen it work (4, Informative)

Nefarious Wheel (628136) | about a year and a half ago | (#42469115)

I've seen it work with multiple AP's in an office that all had the same SSID. Just cloned the boxes (some cheap Cisco thing, can't remember the part number) and never had any issues with conflicts.

Unifi (5, Informative)

ProfessionalCookie (673314) | about a year and a half ago | (#42469569)

If the only think keeping you from a controller based solution is cost try Ubiquiti's Unifi. You can run without a controller and if you need one you can use any old embedded box. http://www.ubnt.com/unifi [ubnt.com]

Re:Unifi (3, Informative)

Anonymous Coward | about a year and a half ago | (#42470929)

This guy has it. I think the Unifi setup rivals the cost of their other ap's, too, like the Bullet M2 HP and the PicoStation (best outdoor AP for the $). Even better is that as of AirOS 5.5, multiple VLANs are supported. This gets a bit whacky thanks to their vague user-manual and uninformative GUI but is well worth it given the cost and good customer service. It takes some playing around with to understand how they do the VLAN tagging.

To properly configure client roaming between the AP's, simply name them all with the same SSID and scale their power output to have about 10% overlap. This will give allow the client's to make the best decisions when roaming from one AP to another but also helps conserve your client's battery life. Be sure to keep adjacent AP's on separate channels.

Jeremy Cioara does a good job of explaining this in his CCNP Switch series over at CBTNuggets.

Re:Unifi (2)

mokomull (630232) | about a year and a half ago | (#42470935)

This is only marginally different from separate access-points, though. Their "controller" is only for management -- it doesn't do anything for helping users roam between the APs, for instance. You need actual enterprise-class equipment if you want that.

Re:Unifi (0)

Anonymous Coward | about a year and a half ago | (#42471639)

you dont need the controller software to let users roam from one unifi ap to another
the controller software is just for initial management and for web portals for login. other then that the system handles itself quite nicely if it has to restart due to power or network outage as each AP stores its configuration and waits for changes from the management pc/ip

Re:Unifi (4, Informative)

Nimloth (704789) | about a year and a half ago | (#42471349)

+1 for Ubiquiti Unifi. I run the controller on my Macbook, the APs are spread across several locations and some locations have several. Roaming is seemless, quality and features are impressive and they are dirt cheap. 3 packs are 250$, that comes to about 85$ / AP. The controller is included and there is no license to pay or recurring fees.

Re:Unifi (1)

ArhcAngel (247594) | about a year and a half ago | (#42471425)

Came to recommend this. It is dead easy to set up and it works better than I expected it to. I set up multiple SSIDs for different business units and an open hotspot for our guests that is isolated from the rest of the network. The ability to add an office layout is nice if you are adding more than a couple of hotspots and don't remember where HS249 is located. I haven't found anything close at this price point.

Re:I've seen it work (2)

redfox2012 (1150371) | about a year and a half ago | (#42469619)

Indeed, you should be fine! A single SSID across all access points is the way to go but, as the Cisco 1040 series seem to be 802.11n your choice of channels is limited.

Make sure you only use channel 1, 6 or 11 as the others overlap [wikipedia.org] which can confuse clients; you are better off having two of your five arrays on identical channels than overlapping them. Just try to keep the access points with identical channels a reasonable distance apart, so that there is an obvious difference in signal strength.

Does it work mixing G and N access points? (1)

Anonymous Coward | about a year and a half ago | (#42470891)

If an office network mixes brands, models, and 802.11g access points with 802.11n access points, is it still best practice to have them share SSIDs?

Re:I've seen it work (1)

wgoodman (1109297) | about a year and a half ago | (#42471519)

Why not get a couple routers, set up DD-WRT and use WDS. That's what it's there for and it's simple to configure.

I thought it was standard (3, Interesting)

pclminion (145572) | about a year and a half ago | (#42469149)

I thought that was the standard way of doing it anyway. Is it not?

Re:I thought it was standard (5, Informative)

Dishwasha (125561) | about a year and a half ago | (#42469329)

Yes, that is the biggest mistake no-name wireless installers and IT consultants (i.e. the guy installed a wireless AP in his house and now he's an expert) do with small businesses is they use different SSIDs and WEP keys for each access point. It is extremely annoying. Use the same SSID and the same WEP/WAP key for each access point. In the 802.11X standard, it is the responsibility of the wireless client to automatically determine which AP is best and automatically switch and potentially hop channels. You will want slight overlap of the wireless zones, but don't place them too far away or to close to each other. Be aware of any areas where a "firewall" is installed (not an electronic firewall, but a wall with extra insulation that protects different areas from spreading fire) and plan APs accordingly. One you place the APs with approximate locations, do a slow walk-around with your laptop and use airsnort [shmoo.com] to get signal strengths and tweak AP location before physically installing them in the ceiling or walls or wherever. A popular thing for businesses with the removable ceiling tiles is to cut a small hole in the tile and let the APs antenna(e) point downwards in to the actual normal airspace. Of course, this typically requires running power in to the crawlspace somehow.

Re:I thought it was standard (1)

Anonymous Coward | about a year and a half ago | (#42469737)

I've actually had reasonable luck with AP's above the drop ceiling without putting the antennas through.

But otherwise this is exactly how I do it. AP's are spread throughout the building, all the same SSID & WAP cred. I do use different channels in different areas, and it doesn't seem to confuse the wireless clients.

Re:I thought it was standard (0)

Anonymous Coward | about a year and a half ago | (#42469945)

bump 'er up....

Re:I thought it was standard (1)

Anonymous Coward | about a year and a half ago | (#42470521)

I use gear than can run on POE when I set up something above the ceiling tile

Re:I thought it was standard (4, Insightful)

GlobalEcho (26240) | about a year and a half ago | (#42471149)

Be aware of any areas where a "firewall" is installed (not an electronic firewall, but a wall with extra insulation that protects different areas from spreading fire) and plan APs accordingly.

You know a website (viz Slashdot) is geeky when quotation marks have to go around the original meaning of the word firewall.

Re:I thought it was standard (2)

DigiShaman (671371) | about a year and a half ago | (#42469381)

It will work headless using a bunch of random APs with the same SSID, but reliability is iffy at best. The point of a wired controller managing APs is so it can intelligently manage WiFi channel allocation and load based on all sorts of factors including SNR levels and channel usage overlap.

Re:I thought it was standard (0)

Anonymous Coward | about a year and a half ago | (#42469391)

I do it this way with two cheap Linksys access points. Same SSID, same pass-phrase, different channels. MAC filtering enabled.

Having to occasionally update the MAC filter list twice isn't much of a labor. Thou depending on how many access points you have and how often you have to make changes would depend on how boring that might get.

Re:I thought it was standard (3, Interesting)

hawguy (1600213) | about a year and a half ago | (#42469583)

I do it this way with two cheap Linksys access points. Same SSID, same pass-phrase, different channels. MAC filtering enabled.

Having to occasionally update the MAC filter list twice isn't much of a labor. Thou depending on how many access points you have and how often you have to make changes would depend on how boring that might get.

Why use MAC filtering?

It does nothing to stop someone that's interested in joining your network - if they can hack your WPA key (or steal it from someone's desk), the MAC is not an impediment at all -- it's broadcast in plain text.

All MAC filtering does is keep honest users off your network, but if they are that honest, they probably aren't going to get on your network in the first place.

If you're looking for security, setup a RADIUS server and use 802.1x authentication instead of PSK.

Apple (1)

Anonymous Coward | about a year and a half ago | (#42469151)

The Airport Extreme's seem to handle this fine. I setup several using the same SSID to extend the signal.

Re:Apple (0, Troll)

Anonymous Coward | about a year and a half ago | (#42469559)

Other than the painful nonstandard setup, there's nothing particularly unique or interesting about Apple's wireless hardware or its performance.

Re:Apple (1)

Anonymous Coward | about a year and a half ago | (#42469677)

Compared to most of the cheap crap you find out there, they're remarkably stable and do have high performance. I've had various Buffaloes and Linksyses, and even with various forms of WRT, they tend to die and need a reboot eventually.

Re:Apple (1)

Anonymous Coward | about a year and a half ago | (#42470727)

(Same as grandparent AC, too lazy to login)

Your qualitative observation has no more value than mine, and my experience is that there's an Airport Extreme in my office that I have to reboot at least once a week. I've had very similar experiences with high end consumer and SOHO products almost uniformly and regardless of brand.

Apple needing its own goofy management app with no provision for configuration by HTTP is particularly annoying though.

Ubiquiti Wireless (3, Interesting)

Anonymous Coward | about a year and a half ago | (#42469159)

I would highly encourage you to look at the Ubiquiti UniFi system. Software based centralized computer and basic APs are only $66. We're switching to them from Cisco and have been very happy.

http://www.ubnt.com/unifi

Re:Ubiquiti Wireless (2)

jaseuk (217780) | about a year and a half ago | (#42469223)

They are pretty good, but really work just the same way as the OP described.

Unifi offers a pretty convenient way to monitor and configure a larger number of access points without anywhere near the cost or infrastructure required with a controller.

Re:Ubiquiti Wireless (1)

gbkersey (649921) | about a year and a half ago | (#42469239)

Thanks for pointing Ubiquiti's UniFi system out. I use their equipment for bridging locations together and it has been really good...

Re:Ubiquiti Wireless (1)

gbkersey (649921) | about a year and a half ago | (#42469263)

Argh! Their routers / bridges run Linux. Why is this software not available for Linux?

Re:Ubiquiti Wireless (1)

TooMuchToDo (882796) | about a year and a half ago | (#42469321)

Not everything that runs on Linux is open source.

Re:Ubiquiti Wireless (1)

gbkersey (649921) | about a year and a half ago | (#42469579)

And your point is? My point is that I don't want to rely on Windoze for infrastructure tasks....

Re:Ubiquiti Wireless (1)

hjf (703092) | about a year and a half ago | (#42470835)

I wouldn't hire anyone using the word "Windoze".

You know, professionalism, yadda yadda.

Re:Ubiquiti Wireless (1, Insightful)

epyT-R (613989) | about a year and a half ago | (#42471473)

well, I wouldnt hire anyone citing 'professionalism' as justification for anything. Fallacious ' reasoning' is the cornerstone of passive- aggressive office politics.

Re:Ubiquiti Wireless (5, Informative)

lebean (638838) | about a year and a half ago | (#42469367)

It's available for linux, go to the forums at their site, the UniFi section and look at any version announcement. They even have a Debian/Ubuntu repo, if you're on RHEL/CentOS you just grab a tarball and install the mongodb bits yourself.

Re:Ubiquiti Wireless (1)

gbkersey (649921) | about a year and a half ago | (#42469571)

Cool....

Re:Ubiquiti Wireless (1)

hjf (703092) | about a year and a half ago | (#42470877)

I use their cameras. The cameras are OK (not awesome), but the management software just plain SUCKS. You can't schedule it to auto-delete old recordings! So you can't have a "set it and forget it" thing.

But, their linux support is fantastic. I can't believe "apt-get install airvision airvision-nvr" JUST WORKED. Impressive.

Oh, and their 900Mhz APs.. man, that is awesome. I have two locations 1 km apart with a couple 8-10 stories tall buildings right in the path, and I get a steady signal. At only 6mbit, it sucks, but that's impossible to do in other bands. And for less than $100 each!

Re:Ubiquiti Wireless (0)

Anonymous Coward | about a year and a half ago | (#42469293)

I second unifi. FWIW, I'm 'esseph' on the forum there. PM me if you need a hand.

Re:Ubiquiti Wireless (1)

wolrahnaes (632574) | about a year and a half ago | (#42469957)

Adding another vote for UniFi. I took a shot on them because they were cheap, basically a last chance for Ubiquiti as I had been burned by a lack of support on the RouterStation Pro a few years back. So far it's turned out to be a good choice. I have two customers running six APs each who are very happy with them, another rolling out nine (they're offered in a discounted three-pack, so multiples of three are a matter of convenience).

The "controller" package is only really used for configuration, firmware updates, and running the captive portal as opposed to a traditional wireless controller, but this means it's light on resources even though it's Java-based. It is a properly done Java app at least, and not only runs on all major OSes but even runs well on non-x86 CPUs. Pretty much any server with a bit of spare CPU power can run it, or if there isn't a server around people have run the controller on Raspberry Pi units.

If I were your client... (0)

Anonymous Coward | about a year and a half ago | (#42469185)

I would be fine with the multiple APs and single SSID but I would prefer you not deploy them with a PSK. 802.1x with a Radius implement of some sort would be a good starting point.

Simple to do (0)

Anonymous Coward | about a year and a half ago | (#42469229)

It's rather simple to do - we have 3 access points in our home. All you have to do is give them all the same SSID, and put each individual one on separate channels. Also, give each router a static IP address and remember to turn off DHCP.

Alternatively, you can use wifi extenders.

Re:Simple to do (1)

alostpacket (1972110) | about a year and a half ago | (#42469673)

Do any of your APs act as repeaters? I tried this but was having some trouble with devices on the network being able to see each other among other bizarre errors.

It sorta hands off, but not by design. (1)

Anonymous Coward | about a year and a half ago | (#42469235)

What you are talking about will work fine in smaller offices. As far as I can tell, though, there is no handover when a signal is poor, only when it is lost. The laptop will stay connected to whatever the original access point is until it can not contact it anymore. If the distance increases after initial connection and the signal becomes crappy, it won't automatically connect to a closer AP until the original connection drops completely.

That said, Cisco does make some equipment that handles that, I believe. In my environment, I only need 2 APs to cover my building, so I decided I didn't need that more expensive solution.

Re:It sorta hands off, but not by design. (0)

Anonymous Coward | about a year and a half ago | (#42471383)

This is exactly something I've been looking for a solution to for a while. How to make a client re-associate when there is a stronger signal strength AP closer, without actually having to drop the connection to the initial access point first....

Apple hardware does this (0)

Anonymous Coward | about a year and a half ago | (#42469253)

The airport express/airport extreme will do this as well. I have a two story house and I have a airport express and two extremes all on the same SSID and password. I don't know if apple makes a windows version of the airport utility however.

Re:Apple hardware does this (0)

Anonymous Coward | about a year and a half ago | (#42469447)

They do:

http://support.apple.com/kb/index?page=answerlink&url=http%3A%2F%2Fsupport.apple.com%2Fkb%2FDL456&answerid=16777216&src=support_site.kbase.search.searchresults

Set up (1)

Jagjr (1734396) | about a year and a half ago | (#42469257)

I've set a few up and it's relatively simple. Make sure they have the same SSID - Passphrase and Security type (WPA2-PSK is what i use). Just make sure you have one doing DHCP or atleast a box on your network doing it and just kick the rest into bridge mode.

Re:Set up (0)

Anonymous Coward | about a year and a half ago | (#42469767)

My experience is that using pre-shared keys in an office with more than a couple employees is bad news. Be careful.

Is there any other way? (3, Informative)

hawguy (1600213) | about a year and a half ago | (#42469267)

Is there another way to do it? I've always set office (and my home) Wifi networks up like this -- as long as the AP's are all on the same subnet, roaming among them should be fairly transparent.

Try to use non-overlapping channels as much as possible. (i.e. channel 1 at the east end of the office, channel 6 in the middle and channel 11 at the west end). If you can't use non-overlapping channels, some tuning of power levels to prevent interference between nodes can help -- i.e. if you have a long office with 4 nodes on 3 channels: [1, 6, 11, 1] you may see better performance if you turn down the transmit levels on the two channel 1 nodes so they don't interfere with each other as much. And dual-band 802.11n can help even more both because there's more channels on 5Ghz, and because the 5Ghz signals will be attenuated more.

In my current office, I have about 120 Wifi nodes (through a Cisco WLAN controller), all are broadcasting the same SSID.

Re:Is there any other way? (1)

Anonymous Coward | about a year and a half ago | (#42469441)

ubiquity. makes acess points that will mesh without a controller, they are cheap too (about $90 each).

Re:Is there any other way? (2)

postbigbang (761081) | about a year and a half ago | (#42470491)

You can stagger on the low bands to avoid overlapping channels, or if the machines are modern, and support N-high, then use the non-adjacent N channels for even wider, non-overlapping support. Using N-high as your propose is a great idea, and forcing users to N if their hardware uniformly supports it, will speed the hell out of the network; make sure you have sufficient backhaul for the traffic, which could get huge. Also make sure you stagger DHCP IP address ranges to help preserve sessions.

Sadly, some RPCs will destroy sessions when you change APs, as will certain IPSec VPN-based connections during AP roaming. Session roaming often can work seamlessly, but some apps will balk, including printing/scanner/shared-network-peripheral apps and others. Have users stand still if they're using them if their sessions are getting hosed. Finish printing, then walk out of the conference room, etc.

WDS (0)

Raven42rac (448205) | about a year and a half ago | (#42469287)

This problem has been solved already, it's called WDS. http://en.wikipedia.org/wiki/Wireless_distribution_system [wikipedia.org]

WDS is a security risk (0)

Anonymous Coward | about a year and a half ago | (#42469427)

from the wiki:

Dynamically assigned and rotated encryption keys are usually not supported in a WDS connection. This means that dynamic Wi-Fi Protected Access (WPA) and other dynamic key assignment technology in most cases cannot be used, though WPA using pre-shared keys is possible.

This is due to the lack of standardization in this field, which may be resolved with the upcoming 802.11s standard. As a result only static WEP or WPA keys may be used in a WDS connection, including any STAs that associate to a WDS repeating AP.

WPA and WEP are thoroughly broken and are not even an option if you care at all about security, the state of WiFi security in this decade is a fricken joke.

Re:WDS is a security risk (1)

Raven42rac (448205) | about a year and a half ago | (#42469667)

Well that's a whole other discussion, 120 similarly configured access points is worse, IMHO.

Re:WDS is a security risk (0)

Anonymous Coward | about a year and a half ago | (#42471921)

if you care at all about security, the state of WiFi security in this decade is a fricken joke.

This is my favorite line. My view is that if you cared about security, you wouldn't be broadcasting your network in the first place.

Re:WDS (1)

Anonymous Coward | about a year and a half ago | (#42469435)

This is for when the access points don't have a wired ethernet backhaul, so you can use WDS to interconnect them with wireless. From OP post it seems that he already has the APs interconnected, therefore WDS is not needed at all.

Re:WDS (5, Informative)

pjr.cc (760528) | about a year and a half ago | (#42470033)

WRONG!

This is *NOT* what WDS was designed to do. There seems to be quite a lot of people under the impression that if you want multiple access points co-operating with one another such that clients can roam between them seemlessly, you need WDS. Not sure where that came from but its got nothing to do with that.

WDS is about peer-to-peer AP connections such the data is travelling wirelessly between access points, and while WDS can be the "backbone" of a seemlessly-roaming SSID-consistent WiFi network, its an inherently flawed system. This is typically used for places where you need to bridge networks wirelessly when you cant put down a cable (for eg, you might have two offices across the road from one another).

WDS will also chew up a considerable amount of wifi bandwidth doing this (and the problem gets exponentially worse as you add more AP's/clients).

The point being though that WDS wasnt designed for the purposes of providing distributed access to a wifi network with a single SSID, but to allow AP's to also be clients to each other while still being AP's.

Ultimately the way the guy describes his setup is the correct method of deployment, multiple AP's with the same SSID and encryption parameters, thats all there is to it.

Re:WDS (1)

parallel_prankster (1455313) | about a year and a half ago | (#42470695)

Please mod parent up. The GP has no idea of what WDS is! WDS is like having 2 APs with an wireless "ethernet" connection between them in addition to regular clients. But because it uses the same radios for WDS connection and client connections you lose bandwidth.

Already Answered (1)

Anonymous Coward | about a year and a half ago | (#42469303)

Answered already but it is build into the protocol.

http://superuser.com/questions/122441/multiple-access-points-for-the-same-ssid

cost vs controller (0)

Anonymous Coward | about a year and a half ago | (#42469309)

check out cloudtrax.com, the open-mesh gear might be a good candidate for you, it's cheap and pretty easy to deploy. it's also one time licensing (included in hardware cost)

Old PC + pfSense (1, Interesting)

iMouse (963104) | about a year and a half ago | (#42469345)

Why not install pfSense on an old PC (Pentium 4-class is more than enough) with a couple of NICs and the FreeRADIUS 2 module? Put the APs in bridged mode and set up 802.1x authentication.

If you didn't want to use self-signed certs and a private CA, your only cost would be for certificate purchases/renewals. The cost is negligible if you count your staff IT hours as costing you nothing.

Re:Old PC + pfSense (-1)

Anonymous Coward | about a year and a half ago | (#42469379)

Are you fucking kidding me?

Re:Old PC + pfSense (4, Informative)

ProfessionalCookie (673314) | about a year and a half ago | (#42469589)

Because the power to run a Pentium 4 for 2 years would cost more than getting a modern little embedded box.

PC Cost vs electricity dependent on country (1)

vgerclover (1186893) | about a year and a half ago | (#42470851)

Because the power to run a Pentium 4 for 2 years would cost more than getting a modern little embedded box.

It is in some countries with heavily subsidized electricity and high import tarifs.

Re:Old PC + pfSense (1)

Anonymous Coward | about a year and a half ago | (#42469743)

I'm an admin with several 5508 controllers. They do a whole lot more than 802.1x authentication (hands-off coverage management, rogue detection, fast roaming w/o client reauth, etc). But on a budget, FreeRADIUS is a great solution and your 1040's will support it. It's a very bad idea to use anything except WPA2-Enterprise (essentially 802.1x with CCMP) in an office environment since TKIP is broken and using pre-shared keys is a management nightmare. 802.1x gives you the ability to grant and revoke network access based on computer or user rights. A policy as simple as allowing any LDAP (or Active Directory) computer or user account wireless access as long as their account is enabled will save you countless hours the first time you need to terminate an employee who would otherwise have knowledge (or a laptop with knowledge) of your pre-shared key. We've also had luck in our test labs using 1200 series AP's as RADIUS servers and hosting a small number of 802.1x-enabled AP's using just Windows domain controllers.

Good luck!

even google has nothing about this (0)

Anonymous Coward | about a year and a half ago | (#42469349)

just tried "wireless network multiple access points" on google and no information at all :(

... I'm kidding ! :)
http://superuser.com/questions/122441/multiple-access-points-for-the-same-ssid
http://www.dummies.com/how-to/content/wireless-network-routing-with-multiple-access-poin.html

One SSID Different Channels (1)

Anonymous Coward | about a year and a half ago | (#42469355)

afaik you need to choose one SSID and one password for all the access point, but you should configure them to different channels so they dont interfere with each other. With this setup the client should choose automatically the best access point and roam to the next when he moves to another room.

Mod Parent Up (1)

laing (303349) | about a year and a half ago | (#42470575)

Also be sure to use channels that are spaced far enough apart so as to not interfere at all. (E.g. 1, 6, & 11)

Clients are a pain (0)

Anonymous Coward | about a year and a half ago | (#42469385)

Part of the wireless standard is the clients chooses what ap they connect to, this maybe improve with updating the wireless drivers. High capacity wireless can have problems also make sure your Cisco AP are channel stage as in one is channel 1 the next one is channel 6 the next its channel 11 it's will help with SNR the only company I know that can fix a lot of these problems is Meru where the whole system can run single channel and makes decisions on the clients behalf but it needs s controller to do this.

If you're already spending big money on Cisco... (0)

Anonymous Coward | about a year and a half ago | (#42469399)

...Cisco stand-alone 1040 AP's then set one as the master and configure the others as wireless repeaters. I did that to the first floor of our office building and now roaming between APs is working much smoother than when they were all wired up as individual APs bearing the same SSID. It's almost as good as having Cisco LWAP AP's with a wireless controller.

Re:If you're already spending big money on Cisco.. (0)

Anonymous Coward | about a year and a half ago | (#42469491)

I believe this is the preferred Cisco method, or something similar.

Options (0)

Anonymous Coward | about a year and a half ago | (#42469421)

Maybe Apple AirPort(s) managed via MacOS X Server?

If even that is out of budget, maybe look at OpenMesh? http://www.open-mesh.com

Aruba AP's (0)

Anonymous Coward | about a year and a half ago | (#42469431)

We have a dozen Aruba AP's deployed w/ a virtual controller which floats between the various AP's. the AP's are a bit pricy $600, however I have no complaints supporting close to a 100 clients in our small environment.

PowerCloud (0)

Anonymous Coward | about a year and a half ago | (#42469521)

Check out PowerCloud (see, http://powercloudsystems.com). They will do what you want at a very reasonable fraction of the cost of a Cisco or Aruba system. They can even provide replacement firmware for a few APs mentioned in the thread.

look into mesh networking (0)

Anonymous Coward | about a year and a half ago | (#42469567)

check out meraki gear. they pretty much are using routerboards running busybox (or were, at least) to create a wireless mesh network. if meraki doesn't look proper, i'd generalize a bit and look around for other mesh networking gear. you pretty much hang access points, including a base station, connect your uplink for the wan on the base station, and the other ap's act as extenders for your wan.

Check out these OpenWrt forum posts (0)

Anonymous Coward | about a year and a half ago | (#42469613)

One of my hobbies is messing around with dd-wrt and OpenWrt on various hardware platforms. At home, I have 6 APs in use (3 on 2.4GHz and 3 on 5GHz). I've found that wireless clients will not roam between APs even when all are configured with identical SSID and encryption settings. The clients tend to stay connected until the AP is completely gone, even if you're 10ft from another AP (unless you cycle the radio off/on so it starts looking for the best AP again). So I did some research and found you could build an OpenWrt image that would allow the APs to communicate and deassociate the client when the signal is better elsewhere, but this requires some real messing around. I gather this is where Cisco gained some check marks for Cisco clients roaming between Cisco APs.

https://forum.openwrt.org/viewtopic.php?id=10353
https://forum.openwrt.org/viewtopic.php?id=26290

So you can do this for free but it requires some moderate geekery.

Extended wireless networks do this, no? (0)

Anonymous Coward | about a year and a half ago | (#42469633)

I thought this was inherent in, for example, extended wireless networks (e.g., Airport Extreme / Time Capsule plus Airport Express(es)).

Without a controller (2)

Kernel Kurtz (182424) | about a year and a half ago | (#42469675)

the options are limited. You can use the same SSID on the various APs (separating channels as mentioned). So long as the clients are all on the same vlan (usually a DHCP scope), it will work reasonably well. Most of the protocols are fairly forgiving. If you have WDS capability, by all means use it.

802.1x adds complications, but if you have a RADIUS type server a WLAN controller should be a more realistic consideration.

Aruba makes controller less APs up to 16 units (0)

Anonymous Coward | about a year and a half ago | (#42469707)

We are replacing our 12 Cisco APs that have a 4400 wireless controller with 16 Aruba IAP 105's.
they are really cool devices. You can run multiple ssid's if needed and they all pull their info from 1 AP.

Ubiquity Networks (1)

NicholasPoore (2807795) | about a year and a half ago | (#42469727)

Ubiquity networks provide a product line that are centrally managed and support up to 4 SSID's per access point / network. The management software is a little messy, however the access points are less that $100 each, and come with PoE injectors and mounting brackets for wall mount, or ceiling mount. A really nice clean product.

Re:Ubiquity Networks (0)

Anonymous Coward | about a year and a half ago | (#42469931)

I just bought a 3 pack of their UniFi AP's for home for approx $250. Easy to set up and get running quickly and they provide a pretty decent speed boost over the Cisco home crap I'd bought previously.

I've done this very successfully with DDWRT (1)

Anonymous Coward | about a year and a half ago | (#42469977)

I'm running this configuration in a small office right now with two WRT-54GL routers running DDWRT.

Really great setup, and works seamlessly as I go back and forth between the two offices.
One of the wireless units acts as the router, the other acts as simply an access point and forward's it's traffic to the router over an ethernet cable.
Super simple to setup, the only trick is to make sure that the two units are on different channels.
The cost for both units was less than $100 and the hardest thing was having the building super route the ethernet cable through the ceiling.

Good luck

You did good. (0)

Anonymous Coward | about a year and a half ago | (#42470019)

All WiFi base stations on the same subnet (routing disabled except for the one unit that is connected to broadband; often done by turning off DHCP), each unit has the same SSID, each unit has the same encryption (WPA2 preferred), and each unit has the same password.

It'll Just work..... (5, Informative)

RedLeg (22564) | about a year and a half ago | (#42470039)

It's part of the standard, and I know, cause I helped write it.

Set the SSID the same for each AP. Set them on different channels so that the AP's don't "step on" each other's bandwidth. Roaming is a station-side (client in common usage) decision, so your PCs will automatically pick the AP with the best signal strength.

As far as authentication goes, this all depends on the AP. All should support PSK (preshared secret keys, aka passwords) and in that scenario, set them all to the same value on each AP. The PSK should be at least 24 characters long, and the SSID for the net unique to keep the security at acceptable levels and reduce the possibility of offline dictionary attacks against the PSK.

Assuming the APs support it, Enterprise grade authentication with individual per-user passwords is within reach at little to no cost. You can tie into Active Directory or set up a free AS (Authentication Server) using FreeRadius on a linux box. The definitive reference for doing this with an MS server is a book titled "Deploying Secure 802.11 Wireless Networks with Microsoft Windows". Make sure you check for updates to the book online, and there is an appendix which details how to set it all up in a lab environment, which will let you prove principle without screwing with the production network.

Google around and you will find loads of information on how to do this with Open Source, the key articles being some from Linux Journal from about 6-8 years ago.

Hope this Helps......

Re:It'll Just work..... (0)

Anonymous Coward | about a year and a half ago | (#42471037)

It's part of the standard, and I know, cause I helped write it.

A-HA! There's the culprit!

Re:It'll Just work..... (1)

kriston (7886) | about a year and a half ago | (#42471195)

Perhaps you can help clear up a debate that has been happening on and off for years.

Is it really necessary to space the channels so far apart? It seems to be a conventional wisdom that flies in the face of the intent of the standard. Sure, the spectrum does overlap somewhat, but isn't the protocol and the air interface designed to handle this situation gracefully?

It sure does in the city where we have multiple APs coming in five-by-five on each and every channel.

Thanks in advance!

Google. (0)

Anonymous Coward | about a year and a half ago | (#42470051)

Why anyone would bother to post such an utterly basic question on here and why it would get posted is beyond me.

If you spend 20 seconds on google you wouldnt need to post stuff that took over a minute to write and then who knows how many minutes to wait for a response that helps you. Basically you took atleast an hour to find something out you could have discovered within just a few minutes on google. Or hell, here is an idea, call cisco. Most companies have support for their products that can be helpful to you.

So Ill go with the old addage "google it". Or do you always need constant hand holding?

Re:Google. (0)

Anonymous Coward | about a year and a half ago | (#42470703)

Because Google will tell you if it can be done, and how it can be done, but /. gives you feedback from people that have done it. That can be important when trying to convince the Boss something is a good, or bad, idea.

Aruba (0)

Anonymous Coward | about a year and a half ago | (#42470059)

its worth looking at the controller-less or virtual controller options from Aruba, they are very cost effective and very easy to deploy.

Re:Aruba (1)

pjr.cc (760528) | about a year and a half ago | (#42470175)

I work with Juniper and Cisco on no-wifi, and for the last 18 months we've been doing wifi with aruba too... couldn't agree more, they're quite fantastic and gained something of a reputation for doing wifi well (well deserved IMHO).

One SSID is best practice. (5, Informative)

Above (100351) | about a year and a half ago | (#42470075)

Controllers came well after AP's were invented, so people had to solve this problem for years without them as an option at all. Multiple AP's sharing the same SSID and key is exactly how the standard was designed, and was the best practice for deployment for many years. The short answer is, it works great, and is how you should be deploying.

For the long answer, you have to understand what happens when a user needs to switch AP's, and how the controllers improve that process. When a client wants to switch from one AP to another it must dissociate from the first, associate with the second which includes exchanging new session keys, gratuitous ARP to inform the L2 network, and then carry on. This process typically takes between 100-500ms, depending on the client, AP, and random luck. For most users doing most things this is all fine, if you're browsing the web and chatting on IM it's a non-issue.

However, for some clients like VoIP phones and video chat a 100-500ms pause is a disaster. Enter the controller solution. The WiFi protocol was divided between things that require hardware (transmitting at the right time, rf modulation, etc) and things that were all in software, just on the AP like exchanging key material. The hardware kept doing the hardware things, but the software activities were moved to the controller. The advantage is that the entire session does not need to be torn down, the radio can switch AP affinity (BSSID) while using the same key material since the key material is tunned back to the controller from both AP's. A client can now switch AP's in 10-50ms, which for most VoIP apps and video conferencing means seamless connections.

Note to the pedantic: yes, there are some other details, controllers enable triangulation features and some other RF analysis, there are a few protocol nits I omitted, and this omits a lot of important design considerations like proper AP placement and channel selection.

Now, go back to the requirements. If you don't deploy WiFi VOIP phones, and don't have other real time streams, controllers may be a total waste of your money. If the goal is to get users e-mail and web access when sitting in the conference room or courtyard, vendors are selling something not needed when they push controllers.

Second note to the pedantic: Controllers can make networks scale better, so if you're deploying 25+, or more likely 100+ AP's my previous paragraph doesn't apply, but that's not what most people reading this are doing.

So to the OP, yes, put them on the same channel. For less than 10 AP's with no real time requirements it is the best practice, and a perfectly valid way to deploy a WiFi network. A controller may be able to get some advanced features (auto-channel management, threat detection, triangulation), but in most small businesses they are features that would rarely if ever be used. There are thousands of WiFi networks deployed without controllers that work quite well. Do read a good document on how to place AP's and select channels, you'll want to use non-overlapping channels in a grid pattern and try and get it to where clients can always see 2-3 AP's, no more, no less.

If you really want a controller, there are some lower cost options than the big players. Ubiquity has a nice solution in their UniFi line, and Netgear now offers an appliance based controller. Aruba has several mid priced offerings. They don't all have the features of say high end Cisco gear, but offer a lower cost solution.

Today I understand Wonko the Sane (0)

Anonymous Coward | about a year and a half ago | (#42470141)

This right here is my instructions on a box of toothpicks. The fact that they come in several vendor defined languages only serves to reinforce the painful insanity here.

There is no way setting up an n APs, with n ESSIDs, and n keys will ever be a better solution performance-wise than n APs, with 1 ESSID, and 1 key.

This will hold true whenever n is constant across both scenarios, and those APs are otherwise configured the same.

This isn't to say that this would be a great solution above a particular density (power density, station density, bandwidth density, whichever crosses the line first), but that line isn't necessarily easy to define. Just mind your design, output, power and channel plan.

Why? (1)

Lumpy (12016) | about a year and a half ago | (#42470167)

Why write off a proper wireless network right away?

http://www.ubnt.com/unifi [ubnt.com] I can put in a 4 AP managed system with a cheap PC as the controller for less than the cost of ONE stand alone Cisco AP.

Plus it's better quality that anything you can buy from Dlink, Cisco, etc...

DHCP Server? (0)

Anonymous Coward | about a year and a half ago | (#42470399)

I am not seeing in the oft-repeated scenario here of multiple AP's with the same SSID and pasword/key how DHCP serving is managed.
Would each AP be a DHCP server for whichever client connects? Should each offer an IP from a unique range within the same subnet? Any other guidelines related to that?

TIA

For a nice little channel range checker, consider the "Wifi Analyzer" Android app (maybe it has iOS version, too?). It has a nice graphical display of strength of multiple AP's within range, and the channels they use. On an Android tablet or phone with good wifi hardware it is much more convenient than lugging a notebook PC around.

HTH
--
RO

Re:DHCP Server? (2)

chris234 (59958) | about a year and a half ago | (#42471499)

Generally you'd want to use some other device for DHCP, probably your router in a SOHO setup.

Aruba Intstant (0)

Anonymous Coward | about a year and a half ago | (#42470419)

We use a product from Aruba Networks called Aruba Intant AP for wireless access at our offices. They call it "controllerless" but really you configure the first AP with SSID and security settings then just plug more APs into the same network and they auto-configure and adjust to minimize interference. If the controller AP goes down the other APs elect a new controller and service continues uninterrupted. It is for small deployments (I think a max of 16 APs) but has worked well for our purposes (WiFi bar code scanners, several laptops and some WiFi printers).

Couple of other points about controllers.. (1)

pjr.cc (760528) | about a year and a half ago | (#42470423)

as everyone's stated, what you've done so far is correct.. IMHO, controllers are well worth the money - though shop around, cause (again, IMHO) juniper and cisco are way too expensive for what they are.

What a controller will give you is a unified simple way of managing it all. I.e. configure it in one spot rather then every AP. They also often include things like portals, authentication services and firewalls. I.e. a central CA for using certificate based auth, a captive wifi portal for open access points that go to the internet or stuff like that.

Where that becomes GREAT is trying to debug stuff, when you get past 4 AP's it starts to get a little tedious making sure every AP is configured correctly (i.e. same SSID, same authentication info), and gets really hard to maintain channel separation effectively. Alot of controller based systems will distribute the channels well based on the topology of your AP network, and that is very handy.

All of this is doable manually, what a controller can do that you cant do anywhere else is force handoff from one AP to another. AP Clients typically head for the closest AP based on signal strength alone and that can get a little annoying because you'll often end up with several AP's that are flooded and others that are barely used, controllers can manage that and push clients off one AP and tell them to use a different one.

The other bit that is mighty hard to do with out a controller is running multiple SSID's from the same AP's connected to different networks (and often the firewall in the controller plays a part in this too). It can be handy in some situations to have a "visitor" SSID thats open access but only gets internet along side an "internal" SSID that gets on your internal network and maybe authenticated via certificates. Controllers handle that very well.

I did it with cheap Linksys APs once... (1)

trparky (846769) | about a year and a half ago | (#42470791)

I did it with cheap Linksys APs once. All I did was to see the SSID to be the same on all three Linksys APs but with different channels broadcast channels. I was then able to seamlessly transition from one AP to the next hoping from one to the other with no issues.

It just works (1)

manu0601 (2221348) | about a year and a half ago | (#42471099)

Multiple AP with same SSID just works, and moving client switch from an AP to another smoothly. You just have to take care about channels used by your AP: try to have as few overlap as possible.

How do you load balance without a controller? (0)

Anonymous Coward | about a year and a half ago | (#42471109)

One of the things that worries me is that people walking around in a way that gets them to overload a single AP. Let's say that the normal limit of an AP is 25 to 30 clients. In this case, how do I make sure that a client chooses an AP based on signal, but that existing connections/load of an AP is also taken into consideration.

You are able to install a controller based Wi-Fi.. (1)

PhunkySchtuff (208108) | about a year and a half ago | (#42471215)

I am not able to install a controller based Wi-Fi solution in my office due to cost...

Yes, you are.

Check out UniFi by Ubiquity Networks [ubnt.com] - they're cheaper than you think (in the same ballpark as premium consumer wifi gear) and the controller is a software instance you can run on just about anything. Management is through a web browser and is dead easy.

The wifi networks have great throughput, the Pro access points have 3x3 MIMO, and they're stable and reliable.

You also get some other good features, such as traffic analysis and reporting, a captive portal for guests that can either use tickets (generated in the controller software) or via a PayPal gateway if you want to start charging people for access and plug-and-play for adding new APs to the network.

Disclaimer - I have deployed a number of Ubiquity networks for my clients, and they're all working successfully.

Name-brand controller alternatives. (0)

Anonymous Coward | about a year and a half ago | (#42471613)

If you're not up to controller scale, Aruba Networks has a little system called "Instant" which may meet your needs. Several APs essentially talk amongst themselves and one of them is designated as a virtual controller for the others (with some contingency for failover if that one goes down). You still get good enterprise-grade APs that can handle tens of clients each without failling over, and it looks like they've substantially expanded the line of equipment that this is offered for. Worth a look?

Alternatively, Meraki, if you're willing to buy their whole "cloud-managed" side of things.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...