0

I want to create a wi-fi network for guests using access points.

I asked to the IT provider a dedicated network with its VLAN and it is: 172.16.0.0/24 VLAN ID 344

The above network is configured on the 2nd port of the provider's router.

I have 3 NETGEAR switches, one for each floor and for each switch i have 2 Ubiquity APs (6)

Finally, i have already connected the port 2 of the router to the first NETGEAR switch (ground floor)

My question is:

do i need to tag VLAN 344 for each switches port connected to the access points?

or it is ok to just setup each access point with the network 172.16.0.0/24?

Thanks,

Improve this question

2 Answers 2

Reset to default
2

Are you managing the APs manually or are they managed by a central controller?

If they're managed with a controller (like a UniFi Controller), your switch ports only need to be configured with whatever VLAN ID you use for the AP's management interface (to uplink to the controller). The VLAN IDs used by the SSIDs are encapsulated in a sort of tunnel (LWAPP or CAPWAP), so the switches will have no knowledge of those tags. You would just need the controller to be on a trunk interface so it can communicate on each VLAN ID as needed.

If you're managing the APs manually (you log into each one to configure the APs directly), then yes, you will need to have the switch ports in trunk mode, and allow whichever VLAN IDs you use for each of the SSIDs.

As for restricting access for the guest network, most controllers (if you're using one) have an ability to tag an SSID as a "guest" network, which most often automatically limits it to just internet access. If not, or if you don't have a controller, you can always add an ACL to filter out any undesired networks. For example, if you're only using IPv4, you could filter out all of the networks defined by RFC 1918. An example of an ACL might look like:

access-list from_guest extended deny ip any 10.0.0.0 255.0.0.0
access-list from_guest extended deny ip any 172.16.0.0 255.240.0.0
access-list from_guest extended deny ip any 192.168.0.0 255.255.0.0
access-list from_guest extended permit ip any any

This would filter out all of the IPv4 private network ranges but allow everything else (like any public IPv4 networks).

Improve this answer
1
  • Yes, i'm using UniFi controller to manage the APs. I will leave only the default VLAN ID (avoiding to create new one) and use it for APs management interface, then configure the APs network always from the UniFi controller. Sounds very quick. The provider already set the ACLs to prevent undesired traffic inside the intranet but as you said if "guest" network already do it i guess we did unnecessary work. Thanks for the clear explanation.
    – XreOed
    Feb 17, 2021 at 17:59
1

If you want guest traffic to be in its own broadcast domain, then yes, you need a new VLAN on your switches/AP. You will also need trunk-ports across your router and switches/APs. Trunk ports would carry multiple VLANs.

If you only need two VLANs, you could keep your existing traffic in native-vlan and only create a new VLAN for guests.

Hope this helps.

Improve this answer
1
  • Basically i'm interested to route guests traffic to the internet, that network is configured to deny guests navigation over the company intranet. I guess is better to have a separated broadcast domain with another VLAN. Thanks
    – XreOed
    Feb 17, 2021 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.