Dynamic VLAN Assignment

Overview

Dynamic VLAN assignment allows NetKey to instruct the wireless controller or switch to place an authenticated client into a specific VLAN. This enables powerful network segmentation without managing multiple SSIDs.

How It Works

RADIUS VLAN Attributes

NetKey returns these standard RFC 2868 attributes for VLAN assignment:

Tunnel-Type = VLAN                    # Attribute 64
Tunnel-Medium-Type = IEEE-802         # Attribute 65
Tunnel-Private-Group-ID = "100"       # Attribute 81 (VLAN ID)

NetKey Configuration

Per-PSK VLAN Assignment

Assign VLANs to individual PSKs for different users.

Per-Endpoint VLAN Assignment

Assign VLANs to individual endpoints (devices) for iPSK.

Endpoint Group VLAN Assignment

Assign VLANs at the group level for easier management.

VLAN via API

Set VLAN assignments programmatically using the NetKey API.

Create PSK with VLAN

curl -X POST "https://api.netkey.no/v1/psk" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Guest User 1",
    "passphrase": "SecurePass123!",
    "vlan_id": 100,
    "ssid": "Corporate-WiFi"
  }'

Create Endpoint with VLAN

curl -X POST "https://api.netkey.no/v1/endpoints" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mac_address": "aa:bb:cc:dd:ee:ff",
    "name": "Conference Room TV",
    "passphrase": "SecurePass456!",
    "vlan_id": 300,
    "group_id": "iot-devices"
  }'

Update VLAN

curl -X PUT "https://api.netkey.no/v1/endpoints/{id}" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "vlan_id": 400
  }'

Controller Configuration

The wireless controller must be configured to accept VLAN assignments from RADIUS.

Cisco WLC 9800

Enable AAA Override in the WLAN policy profile:

wireless profile policy corp-policy
 aaa-override
 vlan-name default-vlan
 vlan VLAN0100
 vlan VLAN0200
 vlan VLAN0300

Cisco AireOS

Configure Interface Groups and enable AAA Override:

config interface group create dynamic-vlans
config interface group interface add dynamic-vlans vlan100
config interface group interface add dynamic-vlans vlan200
config interface group interface add dynamic-vlans vlan300
config wlan interface-group 1 dynamic-vlans
config wlan aaa-override enable 1

Aruba Controller

VLANs are returned via user-role or VLAN attribute:

aaa authentication dot1x "netkey-auth"
    server-group "netkey-servers"
    enable
    
aaa profile "netkey-aaa"
    authentication-dot1x "netkey-auth"
    vlan-derivation-rules enable

UniFi

Enable VLAN Support in the RADIUS Profile:

1. Go to Settings → Profiles → RADIUS
2. Edit your NetKey RADIUS profile
3. Enable "VLAN Support"
4. Ensure VLANs exist in Settings → Networks

Common Use Cases

Best Practices

Planning

• Document your VLAN scheme - Create a map of VLANs to roles/purposes
• Use consistent VLAN IDs - Same VLAN IDs across all sites
• Set default VLANs - Configure fallback VLAN for unassigned users
• Test before production - Verify VLAN assignment in a test environment

Security

• Implement firewall rules - Block inter-VLAN traffic where not needed
• Use least privilege - Start restrictive, grant access as needed
• Monitor VLAN changes - Log and alert on VLAN assignments
• Regular audits - Review VLAN assignments periodically

Operations

• Use groups for scale - Assign VLANs at group level when possible
• Automate with API - Integrate with provisioning systems
• Plan for quarantine - Have a restricted VLAN for compromised devices

Troubleshooting

Viewing VLAN Assignments

Monitor VLAN assignments in NetKey Auth Logs.