Solved

Proper way for setting up Cisco WLAN guest access on seperate subnet

Posted on 2014-04-22
10
742 Views
Last Modified: 2014-04-23
Hello all.

First off, here is our setup.

Main LAN Subnet 192.168.1.0/24
WLAN Controller 2504 on subnet above
Cisco ASA 5505 on subnet above.

We are currently almost maxed out on our IP addresses.  

What we are trying to accomplish is to have all wireless users on a separate subnet (e.g. 192.168.50.0/24).

What is required hardware wise, do we need a Cisco Router?  We have our DHCP server on 192.168.1.0/24 subnet and would like that to assign addresses to all users on the 192.168.50.0/24 subnet.

I know this can not be as complicated as I am making it.

Please advise, thank you!
0
Comment
Question by:Jesh1975
  • 5
  • 3
  • 2
10 Comments
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 40016709
my two cents:

1. check if there are other APs around working on the same or close WiFi channel(s). if yes, try to manually change the

2. check if the MTU is correct or proper. normally for LAN connection, its value should be 1500.
0
 
LVL 17

Accepted Solution

by:
Garry-G earned 500 total points
ID: 40016723
Not really sure what either of bbao's points have to do with the question, but valid points none the less as far as performance goes ...

You shouldn't need a router, asa should be sufficient ... anyway, you might need a plus license for the additional VLAN interface, not sure ATM ...

Just a rough draft:

make sure your WLC and ASA are hooked up to trunk ports on the switch, decide on a VLAN ID and configure it on the switch
set up an additional SSID and terminate in separate VLAN
configure the VLAN as additional interface on the internal LAN in the ASA, with the appropriate subnet you want to use and of course stuff like DHCP (or DHCP helper for forwarding to your regular DHCP server), forwarding rules/filters, NAT etc.

That ought to be it ... ;)
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 40016734
sorry, my comment was posted to another question below. really no idea why it was also posted here

http://mobile.experts-exchange.com/Hardware/Networking_Hardware/Q_28417611.html

anyway, sorry for the inconvenience, if any.
0
 

Author Comment

by:Jesh1975
ID: 40017896
Really quick - I don't really work with VLANs a lot.  I have around 13 switches here, do I need that VLAN to be on all the switches going to the DHCP server?  Or just one switch that the ASA/WLAN controller are connected to? Thank you.
0
 
LVL 17

Expert Comment

by:Garry-G
ID: 40018137
What switches are they? If they have VTP, you could configure a central switch (or two) to be VTP server and automatically distribute the VLAN config from them ...
Anyway, this depends on the way you have the WLC configured ... if you're running everything in central switching mode, all the traffic will go through the controller, so additional VLANs aren't necessary for the APs. In FlexConnect, you will need the VLANs on the switches they are connected to, all the way through to your ASA.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 

Author Comment

by:Jesh1975
ID: 40018184
They are Cisco 2960's, 3560's.
0
 

Author Comment

by:Jesh1975
ID: 40018296
Hm.  Well I have everything configured what I thought was correctly, but no go.  Doesn't the switch need to know some sort of routing?

I have it like this:

ASA Ethernet0/1.50 (192.168.50.1) -> Port 7 on a switch
WLANC Interface (Port 2) 192.168.50.2 (Gateway set to .1) -> Port 8 on a switch

On the switch, Port 7 and 8 are 802.1Q Trunk with VLAN All.  Vlan 50 is configured.  

What is doing the routing, I'm confused here :(  How does WLAN controller know how to get to cisco asa?  Interface GUEST-VLAN (Ethernet 0/1.50) showing 0Kbps....
0
 
LVL 17

Expert Comment

by:Garry-G
ID: 40018317
The WLC is just an L2 device ... do you have the SSID assigned to VLAN 50 as well as configured a VLAN subinterface ?
0
 

Author Comment

by:Jesh1975
ID: 40018322
Yup.  WLAN 'Guests' is assigned interface group guest-vlan which is assigned to port #2, VLAN 50.  IP is 192.168.50.2, 255.255.255.0 mask, 192.168.50.1 gateway (which is IP of vlan on inside interface on asa).

I'm missing something silly I'm sure :(
0
 

Author Comment

by:Jesh1975
ID: 40018451
Well, you won't believe this. I was testing with a static IP and typed in 192.168.5.200 instead of 192.168.50.200.

Haha!!  Thanks for the help, everything works.  Just for future note or anyone else who might need it, NATIVE VLAN should just be 1, correct?
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Working settings for French ISP Orange "Prêt à Surfer" SIM cards for data connections only. Can't be found anywhere else !
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now