Cisco Access Point routing?

Posted on 2009-02-11
Last Modified: 2012-06-21
We have two Cisco Access points 1120s (I think).  They are standalone.  I was wondering if anyone knew how I could  have someone connect to the access point and then have them (through MAC filtering or what have you) just access the internet and not any other aspect of our network.  If I am missing any crucial details let me know.  The APs broadcast at 11Mbs.  W00t
Question by:skarilla
    LVL 4

    Assisted Solution

    You could put the APs on a VLAN that's separated from your LAN by a firewall. This is quite common practice. With the 1200s at least, you can configure VLANs on the AP itself and trunk these through to your core switches, but I'm not sure the 1120 can do this.
    LVL 4

    Assisted Solution

    hi! simply create vlan for only internet on the swich, wich is connected to AP-s. then put those swich ports in that vlan and that will do the trick for you. all your trafic will be only to internet.

    If you want to differentiate users, then it is good to have a radius server, that can authenticate via mac address to both AP-s, allow to auth via radius and based on auth result give ip in the desired vlan, put AP port in trunk mode for both vlans and that will also do the trick.

    Or You will have 2 SIDS for different networks. for example guest and work. Do not need auth. You give out guest for common internet usage and work only for people you want to.

    I hope this is what you seek.
    LVL 23

    Accepted Solution

    Cisco Access points are essentially Layer 2  devices without L3 security features.

    If you have VLAN capable switches, the above is an option, using VLANs is great and the preferred way to isolate the APs at Layer 2.

    Once they are in separate VLANs, you can keep them isolated on your routers,
    even place them outside your firewall or in a "less trusted" zone.

    Otherwise, you need some physical method of segmenting your APs, for it to be secure.

    Either A dedicated network to plug the APs into, i.e. separate switches "For APs"

    Or a router/firewall  behind each AP that controls what it can communicate with.

    A VLAN-capable switch is probably a better investment than a router behind each AP.

    A switch for all APs is only realistic if all APs  can have an Ethernet run to a central location easily.

    LVL 1

    Author Closing Comment

    Thank you all for your help.  I am sorry this took so long but I hurt myself and this took a back seat.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
    This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
    This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
    Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now