• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 326
  • Last Modified:

Cisco Access Point routing?

We have two Cisco Access points 1120s (I think).  They are standalone.  I was wondering if anyone knew how I could  have someone connect to the access point and then have them (through MAC filtering or what have you) just access the internet and not any other aspect of our network.  If I am missing any crucial details let me know.  The APs broadcast at 11Mbs.  W00t
3 Solutions
You could put the APs on a VLAN that's separated from your LAN by a firewall. This is quite common practice. With the 1200s at least, you can configure VLANs on the AP itself and trunk these through to your core switches, but I'm not sure the 1120 can do this.
hi! simply create vlan for only internet on the swich, wich is connected to AP-s. then put those swich ports in that vlan and that will do the trick for you. all your trafic will be only to internet.

If you want to differentiate users, then it is good to have a radius server, that can authenticate via mac address to both AP-s, allow to auth via radius and based on auth result give ip in the desired vlan, put AP port in trunk mode for both vlans and that will also do the trick.

Or You will have 2 SIDS for different networks. for example guest and work. Do not need auth. You give out guest for common internet usage and work only for people you want to.

I hope this is what you seek.
Cisco Access points are essentially Layer 2  devices without L3 security features.

If you have VLAN capable switches, the above is an option, using VLANs is great and the preferred way to isolate the APs at Layer 2.

Once they are in separate VLANs, you can keep them isolated on your routers,
even place them outside your firewall or in a "less trusted" zone.

Otherwise, you need some physical method of segmenting your APs, for it to be secure.

Either A dedicated network to plug the APs into, i.e. separate switches "For APs"

Or a router/firewall  behind each AP that controls what it can communicate with.

A VLAN-capable switch is probably a better investment than a router behind each AP.

A switch for all APs is only realistic if all APs  can have an Ethernet run to a central location easily.

skarillaAuthor Commented:
Thank you all for your help.  I am sorry this took so long but I hurt myself and this took a back seat.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now