• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 703
  • Last Modified:

Segment PIX/LAN traffic to different VLANs for Wireless Guest Access

Currently I have a number of remote offices that have the following configuration.

Cisco 1811W (Wireless & Wired) -> PIX 506E -> Internet

These offices access the internet directly and the PIX has a VPN tunnel to our corporate office.  Each remote office is identical and currently has a completely flat network using the default vlan.

At our main office I support a number of SSIDs linked to different VLANs on Cisco 1100s.  I have a public VLAN that is behind a captive portal that permits internet access for our guests and vendors.  I am attempting to find a way to provide a secondary SSID at these remote offices that is completely independent of the office network.  

I think the only way I can do this is to create a second VLAN on the 1811W and then VPN that VLAN traffic back to my public wifi/captive portal controller.  I can't seem to find a way to originate VLANs on the PIX and trunk them to the 1811W.  I have found a number of references to VLAN support on the PIX, but nothing definitive.  When I do a 'show ver' on my 506e I don't see VLANs listed.

Any help/suggestions would be much appreciated.

1 Solution
the 506e has limited vlan support. to configure a vlan on a pix you create subinterfaces and assign them to the appropriate vlans. and example would be:
int fa 0/0
no shut
int fa0/0.2
vlan 2
nameif guest
security level 50
int fa 0/0.5
vlan 5
nameif inside
security level 100

it might be easier for you to create the subinterface on the router and create an acl to prevent access from the guest network to your infrastructure.

hope this helps,


Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now