We help IT Professionals succeed at work.

Need Recommendation on a Access Point

LockDown32
LockDown32 asked
on
I didn't think the would be this hard but is has turned in to an impossible task. Looking for an Access Point that will let you have multiple SSIDs. One SSID to have internet only. No access to anything else on the LAN (can't even see or ping anything). The other SSID to have internet AND access too other devices on the LAN.
Comment
Watch Question

There are a 1000 ways to skin the technology cat.
Commented:
You will not only require and AP (Access Point) that can broadcast multiple SSIDs but you will also require:
  1. A network switch that can support multiple vLANs
  2. A firewall/router that can support two distinct networks

Need some more info though:
- Do you have devices that require ethernet connectivity? How many?
- Do you require only Wifi devices on your network?
LockDown32Owner
Top Expert 2016

Author

Commented:
I am going to point out the Meraki MR32. It does everything I ask with no VLAN or Router :) That is what I am trying to replace. It is a mixed network. Workstations and WiFi. Guests and Employees both on the WiFi.
LockDown32Owner
Top Expert 2016

Author

Commented:
Well..... I got in a couple Linksys APS and they are heading where you are @nappy_d. The router is already partitioned in to VLANS. The problem seems to be that the VLAN the APs are plugged in to also have printers on it. What they said I needed to do was create yet another VLAN which is "Guest Only" then plug all the APs in to this Guest Only" VLAN and use VLAN tagging on the SSID. Is this where you were heading?
nappy_dThere are a 1000 ways to skin the technology cat.

Commented:
Your physical devices, the AP's, need to be in what's called the management network.  For argument's sake, the vLAN the printers are on is fine for this.

When you configure your SSID's  you need to specify the vLAN ID.

BTW, I'm not too familiar with the Linksys brand of AP's and not saying they are not good.  But can they be managed centrally?  If they cannot, they can cause issues with wireless roaming as devices disassociate from AP1 and re-associate to AP2 or AP3, etc.
LockDown32Owner
Top Expert 2016

Author

Commented:
You kind of hit the main question. When you specify the VLAN ID of the SSID it becomes a part of that VLAN no matter where it is plugged in on the switch?

These are their newer ones (LACAP2600C) that are either centrally managed via the cloud or cluster managed it configuring locally. This particulay model has "Romaing". 802.11N or whatever it is but the endpoints don't really roam.

The issue Linksys said I needed to address is that I don't really have a "Guest" VLAN to point the Guest SSID to. That I needed to create a "Guest" VLAN.
nappy_dThere are a 1000 ways to skin the technology cat.

Commented:
I don't know what their management interface looks like etc or if they support a captive portal for guest wifi etc.

I implement, manage and support Unifi systems which support this fairly easily.

Are you sold on the Linksys or open to other options?

Other Questions:
  • What is the brand and model of your network switch?
  • What is the distance between the AP's
  • How many SSIDs do you need to broadcast?
  • Did you want to implement bandwidth restrictions?
LockDown32Owner
Top Expert 2016

Author

Commented:
I am definitely open to other options. My preference would be Ubiquiti but they do not offer Client Isolation. That is what is making the project so tough. Meraki has client isolation and this Linksys is the only other one I have found that will do that.
nappy_dThere are a 1000 ways to skin the technology cat.

Commented:
They do support this.  As long as the Guest Policy enabled, they will not be able to communicate with other hosts.
LockDown32Owner
Top Expert 2016

Author

Commented:
Well.... this was a long drawn out issue with Ubiquiti. You can still scan the network from the guest network and it will find and display information about all devices on the LAN. You are not "supposed" to be able to access anything on them.......

What they don't support yet is "client isolation". Were wireless clients can't see each other. I guess you need Gen 3 devices and even then the Controller isn't there yet. I like their products but the "support" kind of sucks......