Need help setting up VLAN, Is this even possible?

We have a client who is wanting to provide internet access to guests in their main building via wireless access points.  Our goal is to be able to provide them with this access while separating them from the rest of the internal network, while also providing ourselves with wireless access to the entire network in the main building.

We are using Engenius EAP 9550 Access Points, I have the choice of using a Netgear ProSafe JFS524E or a Cisco Catalyst 2950 Switch, and a our router/firewall is a Sonic Wall TZ170.

I have explored through all the settings and can not seem to figure out how to make this work.  Is it possible to split a port between two VLANs so that one side can not have access to the internal network.  I feel like I have been beating my head on a brick wall trying to figure this out.  So now I am here, can anyone provide any insight into some possible solutions
LVL 1
pennelltechsAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
worpxConnect With a Mentor Commented:
Yes, you can create a VLAN for this purpose to segragate networks. However, the function that you want is in the firewall. Create an ACL to subnet out the ranges you want passing through the firewall.

I would assign a guest VLAN in your switch, assign a separate DHCP range and create a static NAT for that DHCP range in order to allow access to the internet, but not to the internal network, or vice-versa.

0
 
pergrConnect With a Mentor Commented:
Your access points has this feature for you to use:

- Multiple SSID with 802.1q VLAN Tagging (up to 4 SSID)(Access Point mode)


You will need to create one SSID for guests and another SSID for yourselves, and then put each SSID into different VLANs.

Each VLAN will have its oen subnet, and you should treat those as different DMZs on the firewall.

If your firewall can handle VLAN the it can be a single connection between switch and firewall - if not you need to have a separate port for each VLAN.

Obviously you will need to configure the VLANs on the switch too - and the port towards the access point needs to be trunk with .1q tagging.

Your firewall need be DHCP server on each subnet - clearly with different IP subnets.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.