E4200 guest network access restrictions

I have the E4200 router with fw v1.0.01.
I need to provide guest access and limit the hours it is available.
I am not able to use access restrictions because when I attempt to enter the range of IP addresses it forces me to use 192.168.1 and the guest subnet is 192.168.33, therefore it never gets a match when the cutoff time comes. I do not know the MAC addresses of the guests and cannot force them to use predefined static IP addresses, so the range of addresses seems to be my only option. It's just that it won't let me input the "33" where it is needed.
Perhaps I am misunderstanding something or perhaps there is some other way to accomplish this.
Please advise.
Thank you,
-Marty

Thanks for the reply. I'm pretty sure you're right, at least it looks that way. That's a little too open for me. I suppose I could change the config when I want to cut off access, it would just be nice to have it automated.

Similar Messages

EA4500 - Filter Guest Network Access

Is there a way to filter guest network to restrict what services they can access? Support won't email me back.

Guest Network is designed for devices that you do not want to have access with the devices connected to the main network.
What services are you referring to for guest network users to get restricted? You might want to check the link below.
http://www6.nohold.net/Cisco2/ukp.aspx?vw=1&docid=f35bd58fda4148929ac482f3c7968e04_Guest_Network_Fre...

Airport Extreme 802.11AC + 5th Gen and guest network access

I have the current gen Airport Extreme 802.11AC with a 5th Gen extending the network. With this setup, I am unable to login using our guest network setup. I have tried using guest network with a password and one without but its the same results. When a guest logins, it stuck attempting to login with no error messages.
So is it possible to have this configuration and still have guest network access?

Please review what I said originally.......that the guest network function on the AirPort Extreme is designed to work with a simple modem......so the AirPort acts as the main router for the network..
Another way of saying the same thing is that the AirPort needs to be "in charge" of your network for the guest feature to work correctly. The AirPort cannot be in charge if it is connected to another device that is already configured to be the main router on your network.....your Actiontec modem/router.
The Actiontec device combines the functions of a separate modem and a separate router in one package. This type of device is known as a modem/router, or also known as a gateway.
Some folks call a modem/router or a gateway......a modem. So, things can get confusing.
I do not know if it is possible for the Actiontec device that you have to be configured to act as a simple modem.....so the routing functions of the device are completely turned off. (Turning off the wireless on the Actiotec does not turn off the routing function).
If you turn off the wireless on the Actionec, it becomes a modem and a wired router. And that wired router is still in charge of your network.
The guest network feature will not work correctly unless the AirPort is in charge of your network.
My suggestion was for you to ask your Internet Service Provider (ISP), if they could supply you with a simple modem. That is all that you need. You don't need two routers....and the Actiontec that you have now is not allowing the guest feature to work correctly.

Cascading EA4500s and Guest Network access

Hi, I hope esomone can help me here. I've got two EA4500 routers connected via ethernet. The primary router has DHCP enabled and the secondary has it disabled. IP address of primary is 192.168.1.1 and the secondary is 192.168.1.2.
I have set up guest access on both routers however only the primary router allows users to connect. When out of range of the primary router but in range of the secondary router the network is visible but when you try to connect to it, it only gives limited or no connectivity message and can't connect to the internet.
Is it possible for the guest network access to follow the same pattern as the secure network, i.e. the same network throughout the house?
Regards
Jon

Cascading two routers should have correct parameters set. For instance, the Ethernet port of the secondary router should be connected to the ethernet port of the primary one, and the DHCP should be disabled on the second router. The ip address you've set are correct for the both routers. This thing shoud be done if the connection is LAN to LAN.
By the way there are two types of cascading: Click here for info!
For the Guest Network:
Guest Network would only work if the the DHCP is enabled on your router. It means to say that on the type of setup you're doing which is LAN to LAN (DHCP disabled on the second router), Guest network would not work on the secondary router. If the connection is LAN to WAN, then both of the router should have Guest Network working.

ACS User Group Network Access Restrictions

Hi to all,
We have a problem trying to restrict the access for users to an acces point: All users in any group can access the access point, although the group has a network restriction whichs restricts this access.
We have other restrictions which work perfectly. So we are beginning to think that this must be a problem in the access point (Cisco Aironet 1100)...
Thanks in advance,
Coloma Crespí

Hi Andrew,
Thanks a lot for your reply. I was really worried about this problem, I had tried everything to solve it and anything worked...
Regarding what you say, the network access restrictions we have created are the generic ones. I don´t have the option to choose between a dialup or telnet restriction. Where is it? Can you give more detailed information, please?
Thanks in advance,
Coloma Crespí

About Network Access Restrictions

i am using acs3.2,but i find a question about
Network Access Restrictions.i edit Network Access Restrictions in shared profile
components,then i Select the Define IP-based access descriptions check box.i choose aaa client,type the applicable information in each of the following boxes,then click enter and sumbit.when i logging into acs server again,i find the AAA client, port, and address information does not appears as a line item in the table.why ?
Acs version : Release 3.2(1) Build 20

To administer all features included in Cisco Secure ACS 3.2, use an English-language version of one of the following tested and supported web browsers:
Microsoft Internet Explorer version 6.0 with Service Pack 1 for Microsoft Windows
Netscape Communicator version 7.0 for Microsoft Windows
Netscape Communicator version 7.0 for Solaris 2.7
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp32/rn322.htm#wp1043943

E4200 Guest Network Not Working

I cannot get the Guest Network feature to work.
Even though Guest SSID is enabled, it does not show up on any devices attempting to connect. Manually connecting by entering the Guest SSID fails (not recognized). On devices with the primary 5 and 2.4 GHz configured they do see the third network but without SSID (unknown) and are also unable to connect to it manually using the SSID.
Here are my settings:
Firmware: 1.0.02
E4200 is configured in Bridge mode (WAP).
5 GHz Network
Mode Mixed
SSID Astro2-an
Width Auto
Channel Auto (DFS)
SSID Broadcast Disabled
2.4 GHz Network
Mode Mixed
SSID Astro2-bgn
Width Auto
Channel Auto
SSID Broadcast Disabled
Guest Access
Allow yes
Name Astro2-bgn-guest (cannot be changed)
Guest Password testpassword
Total Guests Allowed 5
SSID Broadcast enabled
I did not try this before 1.0.02. Have rebooted modem and verified all configs (multiple times). The network is live in an office and can't keep screwing with it or drastically changing its settings.
Peter
Solved!
Go to Solution.

[email protected] wrote:
I have now tried 3 of these routers and the problem as I see it is when you set the E4200 to bridege mode with a static IP then the client receives a .33.x address receive the E4200's default gateway and a .33.1 as the dns servers. I don't see how the clients could resolve dns with these 2 entries.
Alas, I have think I have now figured out why some people can connect using the E4200 in bridge mode as a guest and some cannot. It is my belief that Cisco needs to update the firmware to allow you to enter dns values on the staic page because if you set the E4200 to obtain an IP address automatically then it receives good DNS info. You can verify my results by looking at the staus page in staic and dynamic mode.
I hope this helps people that are having problems.......
(Mod Note: Edited due to non-compliance of forum guidelines.)
Your findings are correct. However I don't see where adding a static DNS would work. What Cisco needs to do is provide the DNS of the connected gateway for internet access when in bridge mode for guest connections. Then restrict routing to just the gateway for internet access and no local routing.

E4200 Guest Network issues

Hey, I recently set up this router, and enabled the guest network, but it almost never takes me to the login page, and when it loads it takes an abnormally long time. Everything else works. Any suggestions? Thanks.

Did this ever get resolved? We have the e4200 1.0.03 & two wireless devices (one laptop & one desktop) and the cisco page pops up asking for the password = connected. BUT, the other device (desktop) connects to the e4200 but the cisco login page never pops up? BTW The wirekess icon indicates that there is a good connection & signal strength... but not able to access internet :^(
BTWW Already done all the software up grades , turned the computer on and off, rebooted the router and all that. Oddly, this device had a wireless connection a few days ago & now the cisco window doesn't pop up asking for the password. What gives?
Thanks, Ben

Guest Network Access via Lan Port

I bought two of the new Apple Airport Expresses and have the Wireless working just great. I have the second one as an extender also working just as I need it to work. But is there a way to use the LAN port on either of the the units (either the Primary Access Point or the Extended one) to allow someone to connect their computer or other device via hardwire but join as a Guest Participant (so they're segregated from the rest of the network)?
Or is there a way I can connect the device to the LAN port, assign it an IP Address and then use some of the advanced tools to block it from everything else on the network except for using the internet?

No, sorry but the Guest Network cannot be extended either by wireless or Ethernet.
is there a way I can connect the device to the LAN port, assign it an IP Address and then use some of the advanced tools to block it from everything else on the network except for using the internet?
No, this is not possible with the AirPort routers.

Guest Network access

Hello,
Im trying to setup access for our guests to go out a specific interface/ISP
We have our main connection to our datacenter.
We also have a little SAT Receiver that we get internet from (10MB).
I want a specific vlan to go out ONLY to that SAT Receiver connection. Here is my setup:
Guest Network
vlan 216
name WIFI-Guests
SAT Receiver
interface Vlan70
ip address 192.168.151.2 255.255.255.0
interface Vlan216
description Guest WIFI
ip address 10.2.16.1 255.255.255.0
ip helper-address 10.2.1.26
Can this be done via vrf, and how? Or is there an easier way?
Thanks...

Just noticed that you are using an ip helper-address which means you won't be able to use a VRF effectively as your guest network needs access to the vlan with the DHCP server in it.
Assuming you want to keep DHCP for this network on the DHCP server then probably PBR is better ie.
access-list 101 permit udp any any eq bootps log
access-list 102 permit ip 10.2.16.0 0.0.0.255 any
route-map PBR permit 10
match ip address 101
route-map PBR permit 20
match ip address 102
set ip next-hop
int vlan 216
ip policy route-map PBR
note that with the above the first acl has to allow DHCP to get through to the DHCP server. Normally with PBR you would simply use just the one acl eg.
access-list 101 deny udp any any eq bootps
access-list 101 permit ip 10.2.16.0 0.0.0.255 any
but with the 3750 (and some other switches) if you use deny lines in the acl this can cause CPU issues on the switch. So a different acl is used for each PBR entry. The first PBR permit entry uses acl 101 and simply matches DHCP traffic and does nothing so it is routed normally. The second PBR permit statement uses acl 102 and matches all other traffic ie. internet and sends it to the SAT device.
Also worth saying that all traffic is sent to the SAT device but you should also apply an acl on the SVI for vlan 216 to stop traffic from vlan 216 clients to other vlans. The PBR would send this to the SAT device anyway but the SAT device might then route it back to the switch which you don't want. So your acl would look like -
access-list 103 permit udp any any eq bootps
access-list 103 deny ip 10.2.16.0 0.0.0.255
etc. for each internal subnet
access-list 103 permit ip 10.2.16.0 0.0.0.255 any
int vlan 216
ip access-group 103 in
Hope all that makes sense. If not please come back with any questions you have.
Jon

E3000 guest network access problems

Hi,
I have the E3000 router and am using an Engenious repeater. I only turn on the repeater when I'm playing PS3 because it boosts the signal dramatically. However, if someone in my house is connected to the boosted network when I'm using the PS3 I get horrible lag on my PS3. Yesterday I tried connecting the laptop to my guest network while my PS3 was connected to the boosted network, and it worked great. Now, however, I'm unable to connect to the guest network on my laptop. It takes 2 minutes to identify the network and then when it connects it says no internet access. I have the Cisco connect software installed on the laptop. When i run the windows 7 network troubleshoot it detects a problem with the network adapter and says it resolved the problem, but really it just connects me to my main wireless signal and not the guest one.
Thanks in advance for any help

Guest network is unsecured wireless network and it works on 2.4 GHz wireless band.
If you are able to connect to the main network then I think there should not be any problem to connect to the guest network.
The main network has the IP address in the range of 192.168.1.xxx whereas guest network works on 192.168.33.xxx IP address. You have installed the Cisco connect software on your laptop. I think your laptop might be trying to connect to the main wireless network automatically.
You can try upgrading the firmware on your router and see if that makes any difference.

EA3500 - Guest Network Access

Help! Took me 10 years to get another wireless router in my home, because last time, It wasn't secured and people were practically parking in my driveway to use it. Anyway, I have a guest network - unsecured. how the heck do I change it to secured, or eliminate the guest network all together?
Solved!
Go to Solution.

By default the guest network will show unsecured on the available wireless network but in reality it is not really unsecured because once you are connected to the wireless network and you attempt to get online then it will now ask for the guest access password. You have two options on how to configure the guest access password on your router, either by using CCC or the classic ui. If you are using CCC, just access the router’s ui then click on guest access. From there, you will have the options to enable/disable guest access or change the password. If you are using the classic ui, once again access the router’s ui then click on wireless>guest access and from there you will also have the option to to enable/disable guest access or change the password.

E4200: guest networking and MAC filter

Hi there,
I have my e4200 setup with guest networking enabled and also MAC filtering. Somehow i was epxecting MAC filtering not to be applied to guest wireless network but it appears to be so.
Can anybody please confirm if this is the case and if there's a workaround?
Solved!
Go to Solution.

You are correct. MAC filtering is universal in the router. There is no workaround besides not using it.

How to setup 24 hours guest network access with Time Capsule 4th gen. ?

Hello,
I just bought a Time Capsule 2TB and I cannot find the setting to limit the network access to 24 hours.
I updated the firmware and Airport Utility to the latest version and it seems that most of help on this setting I fond on internat are based on previous version.
By example I do not have a "Manual setting" in the "Base Station" menu like described in the manual.
Can someone help on this ?
Thank you and Regards,
Sebastien

Suggest that you download and install AirPort Utility 5.6 for Mac OS X Lion. It will have the settings that you are looking for.
You can keep both AirPort Utility 5.6 and 6.0 on your Mac and use the one that you need.

E4200 Guest Network advanced settings?

Hey guys.
i am interested to know if there is anywhere (even in the code) where i can play with the guest network settings?
Stuff i really miss:
*. ability to change the default webpage login for guest network
*. Ability to set a lease time for guest network
*. Ability to use special characters in the password (@!$%)
is it even possible or an open source firmware is the way to go?
thank you.
Solved!
Go to Solution.

*. ability to change the default webpage login for guest network
- not possible
*. Ability to set a lease time for guest network
- not possible
*. Ability to use special characters in the password (@!$%)
- sadly, it's only alphanumeric but hey, it's case sensitive.
is it even possible or an open source firmware is the way to go?
- AFAIK, no 3rd party firmware has been successful in enabling the guest network.
Also, you might find this link informative.

E4200 guest network access restrictions

Similar Messages

Maybe you are looking for