Purpose

Guide readers through SSID creation with security, VLAN, and RF settings, resulting in a live, joinable wireless network.

Content Outline

What is an SSID?

• SSID = Service Set Identifier (the Wi-Fi network name users see)​
• Each SSID represents a wireless network with distinct security and policies​
• Multiple SSIDs can share the same physical infrastructure (same APs)​
• Best practice: Minimize SSID count (3-5 max) to reduce airtime overhead

SSID Design: The Questions to Ask First
Before clicking "Add SSID," answer these:

1. Who will use this SSID? (Employees, guests, IoT devices, contractors)​
2. What security level? (WPA2/WPA3-Enterprise with 802.1X, WPA2-PSK, Open + Captive Portal)
3. Which VLAN/network segment? (Corporate VLAN 10, Guest VLAN 20, IoT VLAN 30)
4. Where will it broadcast? (Everywhere, or only specific sites/APs)​

Example SSID Design (We'll Build This Together):

• SSID Name: "Corp-WiFi"
• Purpose: Corporate employee access
• Security: WPA2-PSK (for simplicity; WPA3-Enterprise recommended for production)
• VLAN: VLAN 10 (corporate user VLAN)
• Broadcast: All APs in the group
• Bands: 2.4 GHz and 5 GHz

Step 1: Navigate to WLAN Configuration

• In Central, set context filter to your AP group​
• Navigate to "Manage" > "Devices" > "Access Points"​
• Click the "Config" icon (gear icon, top-right)​
• Click "Wireless" > "WLANs" tab
• You'll see the WLAN/SSID table (probably empty at first)​

Step 2: Create the SSID

• Click "+ Add" or "+ New SSID" button​
• Configure basic settings:
  • SSID Name: "Corp-WiFi" (what users see in their Wi-Fi list)​
  • Profile Name (internal): "Corp-WiFi" (keep it simple, match SSID name)​
  • Status: Enabled (so it broadcasts immediately after config push)​
  • Hide SSID: Leave unchecked (hidden SSIDs provide no security and cause connection issues)​

Step 3: Choose Security Type

Option A: WPA2-Personal (PSK) – Easiest for Small Deployments

• Select Security Type: "WPA2-Personal"​
• Encryption: AES (default, secure)
• Passphrase: Enter a strong passphrase (8-63 characters)​
  • Example: "ArubaCorp2026WiFi!" (mix of upper, lower, numbers, symbols)
  • Best practice: Rotate passphrases quarterly​
• WPA2 vs. WPA3: WPA2 for broad compatibility; WPA3 for enhanced security
  • Transition mode: Allows both WPA2 and WPA3 clients (recommended)​

Option B: WPA2/WPA3-Enterprise (802.1X) – Recommended for Production

• Select Security Type: "WPA3-Enterprise (transition mode)" or "WPA2-Enterprise"
• Authentication Server: Configure RADIUS server:
  • Primary RADIUS Server:
    • IP Address: Your RADIUS server IP (e.g., 192.168.1.10)​
    • Shared Secret: Secret key shared between AP and RADIUS​
    • Authentication Port: 1812 (default)​
  • Secondary RADIUS Server (optional but recommended for redundancy)​
• Authentication Method: PEAP-MSCHAPv2 (for username/password) or EAP-TLS (for certificates)
• Role/VLAN Assignment: Use RADIUS attributes for dynamic VLAN assignment

For This Tutorial, We'll Use WPA2-PSK (simpler for first deployment)​

Step 4: Assign VLAN

• Locate "VLAN" or "Client VLAN" section
• Static VLAN (All clients to same VLAN):
  • Select "Static VLAN"
  • Enter VLAN ID: 10 (or your corporate VLAN)
  • All clients joining "Corp-WiFi" will land on VLAN 10
• Dynamic VLAN (RADIUS-based, per-user):
  • Select "Dynamic VLAN"
  • RADIUS server returns VLAN ID via Tunnel-Private-Group-Id attribute​
  • Use this for multi-tenant or role-based segmentation​

Important: Verify VLAN 10 is trunked to your APs on the upstream switch. If not, clients will authenticate but won't get DHCP/IP.​

Step 5: Configure RF Behavior

Broadcast Bands:

• 2.4 GHz: Check to enable (broad coverage, legacy support)​
• 5 GHz: Check to enable (high performance, preferred)​
• 6 GHz: Check if you have Wi-Fi 6E APs and clients​
• Recommendation: Enable both 2.4 and 5 GHz; let band steering push clients to 5 GHz

SSID Broadcast:

• Broadcast SSID: Leave enabled (default)​​
• Why not hide: Hidden SSIDs force clients to actively probe, increasing airtime and causing roaming issues​​

Client Isolation (Optional):

• Disable for corporate SSID (users need to talk to each other, printers, servers)​
• Enable for guest SSID (isolates guests from each other)​

Step 6: Advanced Settings (Optional but Useful)

802.11k (Neighbor Reports):

• Helps clients roam faster by providing AP neighbor info​
• Enable: Recommended (improves roaming)​

802.11r (Fast Roaming):

• Reduces roaming time from ~500ms to ~50ms​
• Enable: Recommended for voice/video clients​
• Mode: "Over-the-Air" (simpler) or "Over-the-DS" (faster, requires controller)​

802.11v (BSS Transition Management):

• Allows APs to suggest better APs to clients​
• Enable: Recommended (works with Client Match)​

DTIM Period:

• Controls how often APs buffer data for sleeping clients​
• Default: 1 (fastest wake-up, most power consumption)​
• For IoT/battery devices: Increase to 3-5 (saves power)​

Step 7: Review and Apply Configuration

• Review all SSID settings:
  • ✅ SSID Name: "Corp-WiFi"
  • ✅ Security: WPA2-PSK, passphrase set
  • ✅ VLAN: 10 (static)
  • ✅ Bands: 2.4 GHz + 5 GHz
  • ✅ SSID Broadcast: Enabled
  • ✅ 802.11k/r/v: Enabled
• Click "Save" or "Apply"​
• Central pushes SSID configuration to all APs in the group​
• Wait 1-2 minutes for config to propagate​

Step 8: Verify SSID is Broadcasting

• From your laptop or phone, scan for Wi-Fi networks
• You should see "Corp-WiFi" in the list
• If not visible:
  • Refresh Wi-Fi list
  • Check AP status (is it "Up"?)
  • Check Audit Trail for config push errors​
  • Verify SSID status is "Enabled" in Central​

Step 9: Test Connection

• On a test device, connect to "Corp-WiFi"
• Enter the WPA2-PSK passphrase
• Wait for connection (should take 5-10 seconds)
• Verify:
  • Device shows "Connected"
  • Device gets IP address in VLAN 10 subnet (e.g., 10.0.10.x)​
  • Device can ping default gateway​
  • Device can reach internet (e.g., ping 8.8.8.8)​

Common SSID Issues and Fixes

Issue	Cause	Solution
SSID not visible	SSID disabled, config not pushed	Check SSID status; verify Audit Trail​
"Cannot connect"	Wrong passphrase, RADIUS issue	Verify passphrase; check RADIUS logs​
Connected but no IP	VLAN not trunked to AP, DHCP failure	Trunk VLAN to AP; verify DHCP scope​
Connected, IP, but no internet	Firewall blocking VLAN, routing issue	Check firewall rules; verify default route​
Slow performance	Legacy data rates enabled, interference	Disable 1/2 Mbps rates; check RF tab​

🧠 Lionel's Tip: SSID Design for the Real World
🧠 The #1 mistake I see: too many SSIDs. I've walked into deployments with 10+ SSIDs per AP: "Corp-WiFi", "Corp-Guest", "Corp-IoT", "Corp-Printers", "Corp-BYOD", "Corp-Contractors", etc. Each SSID broadcasts beacons, consuming airtime and slowing the network. Modern approach: One or two SSIDs, use 802.1X + dynamic VLAN assignment to segment by role. You get the security and segmentation without the overhead. Save multiple SSIDs for truly distinct use cases (e.g., corporate vs. guest).

What We Accomplished
✅ Designed our first SSID with clear purpose and security model
✅ Created "Corp-WiFi" SSID with WPA2-PSK authentication
✅ Assigned VLAN 10 for corporate users
✅ Enabled 2.4 GHz and 5 GHz bands
✅ Configured 802.11k/r/v for optimized roaming
✅ Pushed SSID configuration to all APs
✅ Verified SSID is visible and joinable
✅ Successfully connected a test device and validated IP assignment

Next Week: The final step—comprehensive testing and validation! We'll test multiple device types, use Central's Network Check tools, troubleshoot connectivity, and verify your network is production-ready. You're almost there!