[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 782
  • Last Modified:

Proper way for setting up Cisco WLAN guest access on seperate subnet

Hello all.

First off, here is our setup.

Main LAN Subnet 192.168.1.0/24
WLAN Controller 2504 on subnet above
Cisco ASA 5505 on subnet above.

We are currently almost maxed out on our IP addresses.  

What we are trying to accomplish is to have all wireless users on a separate subnet (e.g. 192.168.50.0/24).

What is required hardware wise, do we need a Cisco Router?  We have our DHCP server on 192.168.1.0/24 subnet and would like that to assign addresses to all users on the 192.168.50.0/24 subnet.

I know this can not be as complicated as I am making it.

Please advise, thank you!
0
Jesh1975
Asked:
Jesh1975
  • 5
  • 3
  • 2
1 Solution
 
bbaoIT ConsultantCommented:
my two cents:

1. check if there are other APs around working on the same or close WiFi channel(s). if yes, try to manually change the

2. check if the MTU is correct or proper. normally for LAN connection, its value should be 1500.
0
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
Not really sure what either of bbao's points have to do with the question, but valid points none the less as far as performance goes ...

You shouldn't need a router, asa should be sufficient ... anyway, you might need a plus license for the additional VLAN interface, not sure ATM ...

Just a rough draft:

make sure your WLC and ASA are hooked up to trunk ports on the switch, decide on a VLAN ID and configure it on the switch
set up an additional SSID and terminate in separate VLAN
configure the VLAN as additional interface on the internal LAN in the ASA, with the appropriate subnet you want to use and of course stuff like DHCP (or DHCP helper for forwarding to your regular DHCP server), forwarding rules/filters, NAT etc.

That ought to be it ... ;)
0
 
bbaoIT ConsultantCommented:
sorry, my comment was posted to another question below. really no idea why it was also posted here

http://mobile.experts-exchange.com/Hardware/Networking_Hardware/Q_28417611.html

anyway, sorry for the inconvenience, if any.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
Jesh1975Author Commented:
Really quick - I don't really work with VLANs a lot.  I have around 13 switches here, do I need that VLAN to be on all the switches going to the DHCP server?  Or just one switch that the ASA/WLAN controller are connected to? Thank you.
0
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
What switches are they? If they have VTP, you could configure a central switch (or two) to be VTP server and automatically distribute the VLAN config from them ...
Anyway, this depends on the way you have the WLC configured ... if you're running everything in central switching mode, all the traffic will go through the controller, so additional VLANs aren't necessary for the APs. In FlexConnect, you will need the VLANs on the switches they are connected to, all the way through to your ASA.
0
 
Jesh1975Author Commented:
They are Cisco 2960's, 3560's.
0
 
Jesh1975Author Commented:
Hm.  Well I have everything configured what I thought was correctly, but no go.  Doesn't the switch need to know some sort of routing?

I have it like this:

ASA Ethernet0/1.50 (192.168.50.1) -> Port 7 on a switch
WLANC Interface (Port 2) 192.168.50.2 (Gateway set to .1) -> Port 8 on a switch

On the switch, Port 7 and 8 are 802.1Q Trunk with VLAN All.  Vlan 50 is configured.  

What is doing the routing, I'm confused here :(  How does WLAN controller know how to get to cisco asa?  Interface GUEST-VLAN (Ethernet 0/1.50) showing 0Kbps....
0
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
The WLC is just an L2 device ... do you have the SSID assigned to VLAN 50 as well as configured a VLAN subinterface ?
0
 
Jesh1975Author Commented:
Yup.  WLAN 'Guests' is assigned interface group guest-vlan which is assigned to port #2, VLAN 50.  IP is 192.168.50.2, 255.255.255.0 mask, 192.168.50.1 gateway (which is IP of vlan on inside interface on asa).

I'm missing something silly I'm sure :(
0
 
Jesh1975Author Commented:
Well, you won't believe this. I was testing with a static IP and typed in 192.168.5.200 instead of 192.168.50.200.

Haha!!  Thanks for the help, everything works.  Just for future note or anyone else who might need it, NATIVE VLAN should just be 1, correct?
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

  • 5
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now