I'm deploying Wireless Access Points with two SSIDs:
employee (VLAN 45) and
guests (VLAN 46). I'm confused how I should configure the Ethernet port on the APs and switch.
My preference would be to configure the switch port as an access port, so that the WiFi end points are locked down. That's what I'd do if there was no
guest WLAN. However, I don't think that will work: Since there will be two VLANs, I believe I need to configure the switch port as trunked. My concern, though, is that making it a trunked switch port opens it up to all VLANs. Even if I restrict the VLANs to 45 and 46 on the switch port, it still means that anyone who, for example, disconnects the AP and plugs in has access to a trunked port.
How can I lock down the Wireless AP switch ports while still supporting two SSIDs and VLANs?