Multiple SSID is a wireless access point feature that enables a single AP to broadcast two or more independent Wi-Fi networks simultaneously, each with its own network name (SSID), encryption standard, VLAN assignment, and client access policy. In industrial environments — factory floors, substations, transportation hubs, and warehouses — Multiple SSID allows one ORing AP to serve OT field devices, employee laptops, and visitor devices on entirely separate network segments without requiring additional hardware. ORing industrial access points ([AP_PRODUCT_MODELS]) support up to [MAX_SSID_COUNT] SSIDs per AP, each independently configurable for security and VLAN isolation.
What is an SSID?
An SSID (Service Set Identifier) is the human-readable network name broadcast by a wireless access point that client devices display when scanning for available Wi-Fi networks. The SSID is transmitted in beacon packets at regular intervals, announcing the presence and identity of the wireless network. When a user or device searches for Wi-Fi, the SSIDs of nearby access points appear as selectable network names.
Key characteristics of an SSID:
- Up to 32 characters (alphanumeric string)
- Can be hidden (beacon suppressed) or visible (default)
- Each SSID on an AP can use a different security protocol: WPA2-Personal, WPA2-Enterprise, WPA3-Personal, WPA3-Enterprise, or Open
- Multiple SSIDs on the same AP share the same radio hardware and frequency channel
How Multiple SSID works
When Multiple SSID is enabled on an ORing AP, the AP broadcasts separate beacon frames for each configured SSID on the same radio channel. Each SSID operates as a logically independent wireless network with its own authentication and encryption parameters. Client devices associate with one SSID at a time using the credentials configured for that network.
Multiple SSID works together with VLAN tagging on the wired uplink:
- Each SSID is mapped to a dedicated VLAN ID in the AP configuration
- When a client connects to SSID A (e.g., the OT device network), the AP tags outgoing frames with VLAN 10
- When a client connects to SSID B (e.g., the employee network), the AP tags outgoing frames with VLAN 20
- The upstream ORing managed switch receives tagged frames and forwards each VLAN to its correct network segment
This architecture provides complete Layer 2 isolation between device groups — a guest laptop on SSID C and a PLC on SSID A share the same physical AP but have zero network visibility of each other.
Per-SSID security and encryption options
One of the key benefits of Multiple SSID is the ability to apply different security standards to each wireless network, matching the security requirements of different device types. ORing APs support the following encryption modes independently per SSID:
| Security mode | Authentication | Typical use | Industrial suitability |
|---|---|---|---|
| WPA3-Enterprise | 802.1X / RADIUS | OT devices, critical infrastructure | ✅ Highest — recommended for IEC 62443 |
| WPA2-Enterprise | 802.1X / RADIUS | Employee laptops, managed devices | ✅ High — per-user authentication |
| WPA3-Personal | Pre-shared key (SAE) | Trusted devices without RADIUS | ✅ Good — stronger than WPA2-Personal |
| WPA2-Personal | Pre-shared key | Employee devices, printers | ⚠️ Acceptable — shared password risk |
| Open (no encryption) | None | Guest portals, public areas | ❌ Not recommended for OT networks |
For IEC 62443-compliant wireless network design, the recommended approach is to place OT devices on a WPA3-Enterprise or WPA2-Enterprise SSID with 802.1X authentication, while providing a separate WPA2-Personal or WPA3-Personal SSID for IT devices and a third isolated SSID for guest access.
Industrial use cases for Multiple SSID
Multiple SSID is particularly valuable in industrial OT environments where different device types have different security requirements and should not share the same broadcast domain.
Factory floor: OT devices + employee laptops + contractor access
A single ORing AP on a factory floor can simultaneously serve: (1) PLCs and sensors on a WPA2-Enterprise SSID (VLAN 10) with 802.1X authentication via a RADIUS server — only registered OT devices can join; (2) maintenance laptops on a WPA2-Personal SSID (VLAN 20) with a department-specific password; (3) contractor and visitor tablets on a guest SSID (VLAN 30) with internet access only, isolated from all production networks.
Railway station or transport hub: passenger Wi-Fi + operations network
Station infrastructure — passenger information displays, ticketing terminals, and CCTV systems — can share a single ORing AP while being logically separated from public passenger Wi-Fi. Operations devices use a WPA2-Enterprise SSID mapped to the operations VLAN; passengers connect to an Open or WPA2-Personal SSID on a separate internet-only VLAN with no access to station infrastructure.
Warehouse: forklift terminals + handheld scanners + visitor access
Warehouse management terminals on forklifts, handheld barcode scanners, and visitor tablets all connect to the same AP but on separate SSIDs with different VLANs. This prevents handheld scanners (which may run older firmware) from being able to reach the warehouse management system servers on the forklift terminal VLAN — reducing the lateral movement risk in the event of a compromised device.
Multiple SSID vs single shared SSID
| Feature | Single SSID | Multiple SSID |
|---|---|---|
| Network isolation | All devices share one broadcast domain | Each SSID is an independent VLAN segment |
| Security per device group | One password / one encryption standard for all | Independent encryption and authentication per SSID |
| OT device protection | OT and IT devices on same network — high risk | OT on dedicated SSID + VLAN — isolated from IT/guest |
| Guest access | Guests share production network or require second AP | Guests on separate SSID with internet-only access |
| Hardware required | One AP per network segment needed | One AP serves multiple segments |
| IEC 62443 compliance | Difficult — no zone separation | Supported — SSID + VLAN maps to security zones |
Frequently asked questions
What is Multiple SSID and how does it work?
Multiple SSID allows a single wireless AP to broadcast two or more independent Wi-Fi networks simultaneously. Each SSID has its own network name, encryption standard, VLAN ID, and access policy. Client devices connect to one SSID and are placed in its corresponding VLAN — traffic from different SSIDs is logically isolated even though all share the same AP hardware and radio channel.
How many SSIDs can one ORing AP support?
ORing industrial access points ([AP_PRODUCT_MODELS]) support up to [MAX_SSID_COUNT] SSIDs per AP, each independently configurable with its own SSID name, security mode, VLAN ID, and bandwidth policy.
Can each SSID be assigned to a different VLAN?
Yes. Each SSID on an ORing AP can be mapped to a dedicated VLAN ID. The AP tags outgoing client traffic with the corresponding VLAN, and the upstream managed switch forwards each VLAN to its correct segment. This provides complete Layer 2 isolation between SSIDs — OT device traffic and guest traffic share the AP but have zero network visibility of each other. See What is VLAN? for more detail on VLAN-based segmentation.
Does broadcasting multiple SSIDs reduce Wi-Fi performance?
Yes, slightly. Each active SSID adds beacon frame overhead — the AP broadcasts a separate beacon per SSID at regular intervals. Up to 4 SSIDs has negligible impact. Beyond 4–8 SSIDs, beacon overhead begins to consume measurable airtime. ORing recommends enabling only SSIDs that are actively used and disabling unused ones.
What is the difference between Multiple SSID and a single shared SSID?
A single SSID places all connected devices in the same broadcast domain with the same access level — a guest laptop and a PLC controller would share the same network segment, which violates OT security best practices. Multiple SSID separates device groups: each has its own credentials, encryption, and VLAN, so guest devices and OT devices have no Layer 2 visibility of each other even through the same AP.
Related resources
- ORing industrial wireless access points — product range
- What is VLAN and how does it work?
- What is 802.1X? How does it work?
- What is IEC 62443?
- OT Cybersecurity solutions
- External: Wi-Fi Alliance — WPA2 and WPA3 security overview (wi-fi.org)
- External: NIST SP 800-153 — Guidelines for Securing Wireless LANs (nist.gov)
