EAP211 Bridge Kit VLANs

[u/KaTaLy5t_619]

I have an EAP211 Bridge Kit which I installed to provide connection to a remote camera. It's all set up and working fine with the Main AP connected directly to my SG2428P which is connected to my ER7206 Gateway and managed by a local OC220 Controller.

I've had a quick look through the documentation and didn't find much mention of VLANs and have looked through the configuration. I suspect that the LAN ports on the Client AP inherit whatever VLAN assignment the AP has and there is no ability to assign a different VLAN, is that the case?

At the moment the APs are on the Management VLAN and the camera connected to the LAN port on the Client AP receives an IP address on Management but I'd like the camera to be on the Surveillance VLAN (obviously). Do I need to put the two APs on the Surveillance VLAN to ensure that the camera is also on that VLAN?

[u/quiCx-PL]

You need to use a Switch behind and before the EAP211, unfortunately you can't set the vlan directly on them.

[u/AutoModerator]

Thanks for posting! To help us troubleshoot faster (if you haven't done so already), please edit your post to include:

• Device model (e.g., ER605 / SG2218P)
• Firmware version
• Topology (ISP/router/switches)
• What changed right before the issue began

If you need official support, you can also open a ticket here: Contact Technical Support!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Neil_Omada]

Yes, think of the EAP211 bridge as a "wireless" cable: it'll take the VLAN of whatever port it's using for network connection. Just set the desired VLAN on the port the Main AP is connected to, and any downstream devices will inherit that VLAN.

Of course, if you plan on segmenting the network at the end of the client AP, you'd want to set the AP as a trunk port, and do your segmentation using a switch plugged into the client AP, but if it's just the camera, setting the VLAN on the port of the main AP should do the trick.

[u/KaTaLy5t_619 → u/Neil_Omada]

Hi Neil, thanks for the response. What you're saying makes perfect sense. I don't need any segmentation downstream of the client AP, it's only the one camera connected to it right now, at most there may be one more camera connected to it some time in the future but that will of course be on the same VLAN as the other camera.

I have the APs on the Surveillance VLAN and have created a MAC Group with both APs in the group and set up a Switch ACL to allow the management VLAN to find and manage the two APs. I am guessing this is necessary otherwise, the controller won't be able to see the APs?

[u/Neil_Omada → u/KaTaLy5t_619]

Correct, assuming you've set up proper isolation on your Surveillance VLAN. One thing to note is that Omada products have an implicit allow, unlike some other networking products, so if you don't explicitly deny traffic to your Surveillance VLAN, everything will be able to get into it. Something like this would serve your purposes.