I've read a bunch of the documentation and made some tests in my Lab. However some things I can't test in the lab and I feel a bit like I'm missing some conceptual insight for designing my network.
Following things are quite fix:
We have a backbone where all APs can see each other on L2.
There are two (adsl modem) gateways also on this backbone. A third adsl could be added for load balancing on the wan side.
We do not serve anything to the wan side (no fixed ip).
There will be three vlans:
vlan101 - internal traffic, cash register, ip phones
vlan201 - employees
vlan301 - freewifi / guests
The APs are spread across the property. (some hAP mini, hAPac3 and Omni5)
I expect 30-40ish clients per AP (will do max. 50) or 300-500 simultaneous clients peak in total.
All APs have L4.
The ethernet ports on the APs will be assigned to vlans, too.
Since I have three hAPac3 (best cpu of all devices) I'd use each of the to be a dhcp server open up the wan side of the ap for dhcp and set up relay entries on each ap for the vlans.
?-> The 200 users limit affects only the hotspot as far as I've read. Will the dhcp server on a hAPac3 serve more than 200 clients?
For static leases in the lower ip range of each dhcp server (/28) there will be static routes (printers on local ports).
?-> Is there any technology that knows/keeps track of which IP is behind which ap?
Expl.: There is one dhcp server. And I can control that devices on local eth ports of an ap do get defined ip ranges so that I can place a static route to them. But I do not know on which ap a dynamic client is. This is a the cash register ipad needs to find a printer problem. The printers unfortunately do not necessarily have fixed ips and might be moving over the property during the day. I don't know how the cash regster does discover the printer.
(I'm not that deep into L2 but could I forward arp from wan to lan and would that solve my problem).
Would some tunnel do a more suitable job on transparently interconnecting these three physical net parts behind a an ap on the backbone together?
This applies only to one vlan since employees and guests are classic web,messenger-wlan clients.
?-> do I need to take further actions in e.g. the firewall to properly propagate broadcasts (*.255) on tcp and udp with my construction.
Expl. I learned that if I want to have vlans on my ssids that I have add the vlan to the bridge.
What happens on the wan side? Is the wan handled like a trunk or are the tags removed?