I want to configure a Cisco 881W to deliver Corporate wired and wireless connectivity, plus Guest wireless connectivity on a second SSID, connected to the core by a site-site VPN. I was expecting to have to use VRFs to separate the Corporate and Guest traffic into their own routing domains, but that's out of my area of experience when running over a vpn backhaul. However, I have read some things about "protected" ports and believe that data ingressing from one protected port will not egress over another protected port. This could make my config much simpler and easier to maintain if my understanding is right.
Has anyone out there got specific knowledge of the "protected" command, and are my assumptions above anywhere near the mark.
As a corollory, I was looking at "protected" because I wanted to set one port "sticky", but the 881W doesn't have that command....or is it hidden? Do I REALLY have to go the hard way and use ACLs and stuff?