Solved

Need help setting up VLAN, Is this even possible?

Posted on 2010-11-17
2
478 Views
Last Modified: 2012-06-27
We have a client who is wanting to provide internet access to guests in their main building via wireless access points.  Our goal is to be able to provide them with this access while separating them from the rest of the internal network, while also providing ourselves with wireless access to the entire network in the main building.

We are using Engenius EAP 9550 Access Points, I have the choice of using a Netgear ProSafe JFS524E or a Cisco Catalyst 2950 Switch, and a our router/firewall is a Sonic Wall TZ170.

I have explored through all the settings and can not seem to figure out how to make this work.  Is it possible to split a port between two VLANs so that one side can not have access to the internal network.  I feel like I have been beating my head on a brick wall trying to figure this out.  So now I am here, can anyone provide any insight into some possible solutions
0
Comment
Question by:pennelltechs
2 Comments
 
LVL 2

Accepted Solution

by:
worpx earned 250 total points
ID: 34156049
Yes, you can create a VLAN for this purpose to segragate networks. However, the function that you want is in the firewall. Create an ACL to subnet out the ranges you want passing through the firewall.

I would assign a guest VLAN in your switch, assign a separate DHCP range and create a static NAT for that DHCP range in order to allow access to the internet, but not to the internal network, or vice-versa.

0
 
LVL 17

Assisted Solution

by:pergr
pergr earned 250 total points
ID: 34163401
Your access points has this feature for you to use:

- Multiple SSID with 802.1q VLAN Tagging (up to 4 SSID)(Access Point mode)


You will need to create one SSID for guests and another SSID for yourselves, and then put each SSID into different VLANs.

Each VLAN will have its oen subnet, and you should treat those as different DMZs on the firewall.

If your firewall can handle VLAN the it can be a single connection between switch and firewall - if not you need to have a separate port for each VLAN.

Obviously you will need to configure the VLANs on the switch too - and the port towards the access point needs to be trunk with .1q tagging.

Your firewall need be DHCP server on each subnet - clearly with different IP subnets.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question