Cisco WiFi Guest network best practices

Hi Guys,
I have to setup a WiFi guest network and I'm wondering what are the best practices.

As a premise I have a Cisco Stack, 1 WiFi controller, and 2 WiFi Access Points, that are currently connected to my users vlan, like one more client (switchport mode access) so the users just connect to the main SSID, provide the password and get an IP address from the same network that my users that connect to the Ethernet cable do.

I'm thinking that I should do the following:

Create a new vlan in the Cisco Stack.
Give access to the new vlan to the ports where I have the Controller and the 2 Access Points connected.
Create a new SSID "Guest_Network".
Create a new DHCP Scope in the Cisco Stack that will provide the IP Addresses for the Guest Network.

So what do I need?

First somebody to tell me if my plan is correct, if not what should I change.

Once the plan is correct, then I need the commands to do all this in the Cisco Stack.

Thanks in advance.
cargexAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KimputerCommented:
If you connect to the Guest_Network, and you already get an IP from a different subnet, usually you did correctly configure it already.
DO NOT enable the InterVLAN routing options though!
0
Craig BeckCommented:
Best practise is to use a dedicated guest anchor controller in a DMZ.
0
Kaiser AnwarCommented:
There are multiple ways to go about this - you can connect on port on the wireless controller directly to the firewall and create a public interface on the Controller and a new guest SSID which will route traffic directly to the firewall or if you are short on interfaces on the firewall then you can plug in the DMZ interface
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

cargexAuthor Commented:
I'm using the same access points for the regular employees network SSID, and the guest network SSID, so it needs to be a solution done at the Cisco Stack to separate the traffic that is coming in through the same port where I connect the Access Point.
0
cargexAuthor Commented:
What I'm looking for is how to create a DHCP configuration in my Cisco Stack that will only serve the Guest Network, and my first guess is that I have to create a different vlan for that guest network.

So the steps would look something like this:
Create vlan
Add Access Point ports in the Cisco Stack to that vlan
Create DHCP Service in the Cisco Stack that will service the guest network vlan only!!!

If you can give me the Cisco commands that would be great!
0
Kaiser AnwarCommented:
I can give you better  details if you can give me details on the physical topology -

but this is what you would need to do

1. create a new VLAN in the Cisco switch stack  
2. create a new interface in the controller and assigned the same VLAN as the switch
3.  define the IP of the DHCP server for the guest VLAN on the interface settings
4. Create a new scope for the new guest vlan

Hope this helps
0
Craig BeckCommented:
There are multiple ways to go about this - you can connect on port on the wireless controller directly to the firewall and create a public interface on the Controller and a new guest SSID which will route traffic directly to the firewall or if you are short on interfaces on the firewall then you can plug in the DMZ interface

...assuming you're not using LAG at the WLC.  If you are using LAG you can't do this.


I'm using the same access points for the regular employees network SSID, and the guest network SSID, so it needs to be a solution done at the Cisco Stack to separate the traffic that is coming in through the same port where I connect the Access Point.

Actually, using a dedicated guest anchor WLC creates a tunnel from the internal WLC to the anchor WLC in the DMZ.  The APs still connect to the internal WLC but the guest traffic gets pushed to the anchor WLC and drops off there in the DMZ.

I really wouldn't advise putting a SVI at your switch stack for Guest just to do DHCP.  That'll enable guest users to get to your LAN unless you secure it properly with an ACL.
0
Kaiser AnwarCommented:
The best setup for the Guest WIFI is to choose a port on the WLC and route this directly to the firewall and assign the DHCP by the WLC which what I recommended  in the first post
0
Craig BeckCommented:
I beg to differ @Kaiser Anwar. The best way to do this is as per vendor best-practise, as per my first post.

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/emob41dg/emob41dg-wrapper/ch10GuAc.html

Using a dedicated port is widely considered to be a poor-man's solution IF you can't go down the guest anchor route.
0
Craig BeckCommented:
You asked for best practise, yet marked a workaround as the answer?!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.