Juniper Mist WLAN Concepts
Juniper Mist WLAN Concepts
This domain tests how a Mist WLAN maps an SSID to security, VLAN, and policy, and how WxLAN microsegmentation controls traffic after association.
From SSID to BSSID
An SSID is the network name; each radio's BSSID is the basic service set identifier clients actually associate to. One SSID can produce multiple BSSIDs across bands and APs. Mist WLAN settings control enabled bands, data rates, client isolation, and whether traffic is bridged locally or tunneled to Mist Edge.
Authentication and VLAN
- WPA2-PSK and WPA3-SAE cover personal networks; WPA2/WPA3-Enterprise uses an external RADIUS server with 802.1X.
- A fixed VLAN assigns every client to one VLAN; dynamic VLAN lets RADIUS return Tunnel-Private-Group-ID per user or device.
- Guest access can use click-through, an external captive portal, or a Mist-hosted splash page, optionally with identity-provider SSO.
WxLAN
WxLAN is Mist's microsegmentation: tags describe users, devices, networks, and applications, and ordered policies allow or block traffic between tagged groups. Tags must be applied to the WLAN for policies to take effect.
Worked example
Contractors must reach only a print server on VLAN 30, while employees use VLAN 10. Use one Enterprise WLAN with dynamic VLAN; RADIUS returns 10 for employees and 30 for contractors. Add a WxLAN policy allowing source tag contractor to destination tag print-server, then a default block. Without the explicit block, the default allow lets contractors reach everything.
Traps
Dynamic VLAN only works when the WLAN's VLAN setting is dynamic; a fixed VLAN ID ignores the RADIUS attribute. WxLAN rules are evaluated in order, so a broad allow above a block defeats the block. Captive portal and 802.1X are separate authentication flows, not interchangeable.