We are designing Wi-Fi coverage for a linear park using 11 BR2 Pro routers distributed across the site, with approximately 9 AP Pro AX units. Each BR2 Pro will establish a SpeedFusion VPN back to HQ 2500EC, all of the APs will use 5 GHz Mesh to extend coverage and lessen the number of BR2 Pro in the park, we cannot use wired ethernet for the APs since we will just install this on each light poles.
Our requirement is to have one common SSID across the entire park, allowing users to roam between APs without having to reconnect or authenticate again.
Can anyone advise on the recommended architecture? Is there anyone did the same project with captive portal on the BR2 Pro units to maintain the same guest network and support seamless roaming with the AP Pro AX?
We are also thinking if this is the case can it be the Balance 2500 EC can act as the AP Controller for AP Pro AX?
Thank you in advance for your feedback.
SpeedFusion VPN is certainly going to be your friend here.
I would give each BR2 pro a unique subnet to use for local traffic, build a rgular L3 SF VPN, but then add on a L2 tunnel too which I would terminate into a VLAN on the 2500EC and use that for the Wi-Fi clients.
That would make the network appear like one flat network to the clients, there would be no Layer 3 roaming required as a client moves across APs regardless of what BR2 they connect from.
You could then run the captive poral on the 2500EC on that VLAN and that would also keep the authentication centralised.
It should be possible to have the 2500EC function as the AP controller for the AP Pro AX, that is where I’d make use of the L3 SF VPN overlay to expose the AP controller to the remote BR2 Pro which again would keep the config for the SSID and AP settings centralised onto the 2500EC.
I’d think this is pretty simple to build a POC for and prove it all works as expected.
Some caveats:
2500EC becomes a bit single point of failure here, if its not an HA pair at least, but also if those tunnels go down you would likely want to configure the APs to turn off the SSID as it would not have any connectivity.
L2 VPN performance would need to be tested, not sure what connectivitive you are feeding the BR2 Pro (cellular only?).
Edit - can’t recall what the limitations are around mixing L2/L3 tunnels on the same SF profile, so you might need to just do away with the L3 ones and build L2 at which point its just a case of making VLANs on the 2500EC that the remote BR2s join onto and considering some management separation on what things are tagged into in terms of SSIDs etc.
1 Like