One SSID, different access 14 min read
Wi-Fi Security and Identity
Separate authentication, encryption, and authorization; then see how 802.1X, RADIUS, and private passphrases place wireless clients into the right AV policy.
- Separate authentication, encryption, and authorization.
- Explain WPA-Personal, WPA-Enterprise, 802.1X, and RADIUS at an AV-engineering level.
- Describe how PPSK, DPSK, or MPSK credentials can assign different policies from one SSID.
- Trace a wireless AV client from successful login through VLAN assignment, DHCP, and access policy.
Three jobs hide behind Wi-Fi security
Authentication proves that a device or user may connect. Encryption protects traffic across the radio link. Authorization decides what the authenticated client may reach afterward. These jobs are related but not interchangeable.
A guest can authenticate successfully and still be prohibited from reaching a Q-SYS Core. That is not a contradiction; it is authorization doing its job. Wi-Fi encryption also protects only the wireless hop, so application protections such as HTTPS still matter.
Personal and Enterprise solve identity differently
WPA2-Personal and WPA3-Personal use a passphrase-based model. WPA3-Personal uses SAE for stronger resistance to captured-password guessing and requires protected management frames. A WPA2/WPA3 transition network supports older clients, but those clients still connect with their older protection.
WPA2-Enterprise and WPA3-Enterprise use 802.1X so an individual device or user can present credentials. The client is the supplicant, the AP or controller is the authenticator controlling admission, and an authentication server—usually reached through RADIUS—evaluates the identity and returns a decision.
RADIUS carries authentication and policy exchanges; it does not transport the tablet's ongoing control or video traffic. EAP-TLS can use certificates instead of reusable user passwords, but certificate enrollment, renewal, and revocation must have a clear owner.
One SSID can lead to different VLANs
PPSK, DPSK, and MPSK are vendor names for families of private or multiple pre-shared-key features. One SSID accepts several passphrases, and each recognized credential can map a device or group to a VLAN, role, expiration rule, or access policy. Ruckus commonly calls this DPSK; other vendors use names such as PPSK, MPSK, or iPSK.
A room tablet, technician, and temporary device can therefore join the same visible SSID while receiving different access. The client normally does not tag its own wireless traffic; the wireless infrastructure applies the resulting policy. Exact capabilities, WPA2/WPA3 support, device binding, and roaming behavior vary by platform and software release.
- Room tablet credential → AV-control VLAN or role.
- Technician credential → restricted service policy.
- Guest credential → internet-only policy.
- Revoke one key without changing every device in the building.
The assigned VLAN still needs a complete path
Password-to-VLAN mapping does not create the rest of the network. In a locally bridged design, the AP uplink and every required switch link must carry the assigned VLAN. The VLAN also needs DHCP, an appropriate gateway, and firewall or ACL rules. In a tunneled design, client traffic may travel to a wireless controller or gateway before entering its policy domain.
When a client connects but cannot control the room, identify the last successful step: association, authentication, VLAN assignment, DHCP, routing, firewall policy, discovery, or the AV application. A self-assigned 169.254 address after successful authentication points toward DHCP or VLAN transport—not another password reset.
Put it in an AV system.
Q-SYS control tablet
Assign the room tablet an individual credential mapped to an AV-control policy. Permit the required Core and support traffic without granting unrestricted access to every switch and device-management interface.
Wireless presentation guest
A guest laptop can have internet access yet fail to discover a wired presentation receiver because of client isolation, cross-VLAN discovery, or firewall policy. Document and permit the required flows instead of opening the entire AV network.
- PSK
- Pre-shared key used for passphrase-based Wi-Fi access.
- SAE
- Simultaneous Authentication of Equals, used by WPA3-Personal.
- 802.1X
- Framework that controls admission to wired or wireless networks.
- RADIUS
- Protocol commonly used between network infrastructure and an authentication service.
- PPSK / DPSK / MPSK
- Vendor-specific families of private or multiple passphrase features that can apply per-device or per-group policy.
- EAP-TLS
- Certificate-based authentication method used within 802.1X deployments.
Follow the successful login
A tablet connects with its private key and the controller assigns VLAN 20, but it receives 169.254.x.x. Verify VLAN 20 across the AP's actual forwarding path, then check DHCP scope, relay, gateway, and policy. Record which step first fails.
Three quick questions.
01Does sharing one SSID guarantee that clients share one VLAN?
No. Identity or credential policy can assign different VLANs or roles from the same SSID.
02Does RADIUS carry the client's normal AV traffic?
No. It carries authentication, authorization, and potentially accounting exchanges.
03Why can authentication succeed while room control still fails?
A later dependency can fail: VLAN transport, DHCP, routing, firewall policy, discovery, or the application.