Three SSIDs, Three VLANs, One AP: How Industrial Wi-Fi Really Works

When multiple wireless networks share one access point, where does the traffic actually go?

Imagine a modern manufacturing plant.

AGVs transport materials between production lines. Operators use industrial PDAs to manage daily tasks. Visiting engineers connect to a guest Wi-Fi network.

All three services share the same industrial wireless access point.

But should they also share the same network?

Not necessarily.

One AP, Multiple Networks

Consider this wireless configuration:

SSID	Purpose	VLAN
Factory-AGV	Automated vehicles	10
Factory-PDA	Industrial handhelds	20
Factory-Guest	Visitors	90

The AP broadcasts three SSIDs, each mapped to a different VLAN.

All three networks reach the wired infrastructure through a single Ethernet uplink.

The key question is: Should the switch port connected to the AP be configured as Access or Trunk?

The answer depends on how wireless traffic is forwarded.

Local Forwarding Changes Everything

In a Local Forwarding architecture, wireless client traffic is bridged directly from the AP into the local wired network.

 AGV ───── SSID 1 ─── VLAN 10 ──┐
                                │
 PDA ───── SSID 2 ─── VLAN 20 ──┼── AP
                                │    │
 Guest ─── SSID 3 ─── VLAN 90 ──┘    │
                                     │
                               802.1Q Trunk
                                     │
                              Industrial Switch

The AP uses IEEE 802.1Q tagging to distinguish traffic belonging to different VLANs.

Therefore, the connected switch port must permit VLANs 10, 20, and 90, typically using a Trunk configuration.

And don't forget the AP management VLAN, which may require its own tagged or untagged configuration.

What About Centralized Forwarding?

With Centralized Forwarding, the data path is different.

Instead of bridging wireless client traffic locally, the AP encapsulates it in a tunnel, commonly CAPWAP, toward a wireless controller.

The wireless client VLANs are then handled at the controller or centralized gateway.

As a result, the AP's switch port does not necessarily need all three service VLANs.

This is an important distinction:

• Local Forwarding: Client traffic enters the wired VLANs at the AP.
• Centralized Forwarding: Client traffic is transported to the controller before entering the service networks.

Local Forwarding can still use CAPWAP for AP management and control. It does not mean the wireless controller disappears.

VLAN Separation Is Not Security Isolation

Here's another detail worth remembering.

Three VLANs provide three separate Layer 2 broadcast domains.

But if a Layer 3 gateway allows unrestricted inter-VLAN routing, the guest network might still reach production systems.

In an industrial environment, this can create unnecessary exposure.

Proper segmentation also requires firewall policies or ACLs to control traffic between AGVs, industrial terminals, and guest devices.

VLANs separate networks. Security policies determine who can communicate.

Final Thoughts

One AP can support multiple SSIDs and VLANs through a single physical connection.

But the switch configuration must match the wireless forwarding architecture.

For locally forwarded SSIDs, the AP uplink typically needs to carry the corresponding VLANs through 802.1Q tagging.

For centrally forwarded SSIDs, those service VLANs may instead be handled at the wireless controller.

The real design question isn't how many SSIDs an AP broadcasts. It's where their traffic enters the wired network.

In your industrial Wi-Fi deployments, do you prefer Local Forwarding or Centralized Forwarding?

---