Guest Internet Access

Hi
Looking for input on Guest Vlan subject.
How can I avoid routing of Guess VLAN traffic to DATA VLAN, any traffic from Guest VLAN should be routed to Internet directly.
Looking for similar setup as in Hotels, Guest are provided with username/password with time duration to access internet and limit the download speed.
Do I need to create another SSID on the WLC and how the guest users will acquire ip, from WLC DHCP or Windows DHCP.
If its Windows DHCP then Guest traffic reaches my Data VLAN
Any Help

We got WLC 4420 ----- Do you mean a 4402-xx
AP 1200 series ( 5 in quantity )
I am new to WLC, can you help me to understand
How many SSID we can configure on WLC, does each ssid can have different config parameters.
The AP's and the Code you might have will only support 8-16. You don't want to configure too many (best practice is around 4) because of all the beacons that needs to be sent might cause issues with certain devices. You can configure eash ssid the same of different, it is up to you. Follow best practices on this.
can we broadcast specific SSID on AP configured with WLC ( AP#1 can be used for SSID DATA & SSID Guest ) ( AP#2 can be SSID Guest & SSID Partners )
You can create WLAN Override (depends on code - http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807669af.shtml) to specify what AP's will braodcast what SSID's. This can be messy if you have gaps for roaming, unless that is not an issues.
For Guest SSID is it recommended to connect to a seprate port on WLC
You have different options:
You can use a guest anchor controller in you DMZ
You can use one port on the WLC connected to your internal network and the other port to the DMZ
You can trunk vlans and use ACL's to block guest traffic from inside networks.
All this depends on you current infrastructure and if you plan on buying more equipment or use the existing.
Instead of creating Guest Users on WLC with time restriction, can this be done third party with ease of management. ( Office secretary can give access to internet to guest )
You can use a NAC Guest Server... if you want to spend a lot of money. You can configure a Lobby Admin account on the WLC so that the secretary has only read/write to add guest accounts. This would be the same if you have WCS with a lobby admin account.
http://www.cisco.com/en/US/docs/wireless/wcs/4.2/configuration/guide/wcsmanag.html#wp1078208
How to have bandwidth control on WLC, restrict users with bandwidth limit
You would need to use a 3rd party tool for this like ZoneCD or again you can use the NAC Guest Server.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns787/data_sheet_c78-456124.html
http://www.google.com/url?q=http://cisco.com/application/pdf/paws/107630/WLC_NGS.pdf&ei=WtSTS9HpN43OM_WnkYoN&sa=X&oi=nshc&resnum=1&ct=result&cd=1&ved=0CAgQzgQoAA&usg=AFQjCNF0eA-Z8nss7WzgpPRnFjtSdZnvWQ
http://www.google.com/url?q=http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns787/DeployingGuestAccess_051308.pdf&ei=WtSTS9HpN43OM_WnkYoN&sa=X&oi=nshc&resnum=1&ct=result&cd=2&ved=0CAkQzgQoAQ&usg=AFQjCNGKgF_wWKQaI8lqHoFfwbg0iztVFg
Any configuration sample link with one Internet connection having DATA and Guest VLAN using ACL to restrict the traffic.
I put some links above... hope this helps. Again, it will come down to your existing environment and how much more you want to spend. You also have to look at the time it might take to setup, will the secertary want to do this, etc? How I see guest access..... well.... they go out a seperate internet pipe, so I don't really care about bandwidth. Its guests so they would have to deal with that anywhere the go, even hotspost or even worse hotels:) Make it simple and make it work... then you can add to that later when you get more familiar to configuration and troubleshooting.

Similar Messages

Guest Internet access in the Enterprise

We have set up guest internet access in our enterprise using GRE tunneling with a PIX. I'm trying to determine the best way to do authentication for users on this guest network.
I think I can do RADIUS (using ACS) with the PIX as an NAS. Question is can I use a different type of server (such as MS IAS)? Can I use either one to utilize an existing MS Active Directory database?
If I use radius on the pix for authentication, a login prompt pops up when a user tries to use the web. Is there a way to redirect users to a web page first and have the login embedded on the page? This is done in hotels now and I don't know if there's a Cisco solution for this.

The following documents lists all the supported Databases,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

EA6100 AC1200 Blocking Guest internet access during specific times?

I see that you can disable guest internet access for specific times but only for specific devices. What I want to do is turn off Guest access for all devices during specific times.
I am using this in an environment where I will have different guests at different times with different devices and can't go in to block each one each time.

I think your only option at this time is to manually disable the Guest Wireless network when wanted.
Please remember to Kudo those that help you.
Linksys
Communities Technical Support

Load Balance guest Internet access via two different DMZ zones at two sites

Hi Sir,
My customer has the following unified wireless guest access requirement:
- There are 2 internet links and dmz zones at two different locations, Site A and Site B
- Data centre is at Site A
- WiSM is proposed to be installed at the Cat 6500 in Site A
- Lightweight AP are distributed across Site A, Site B and other branches
- Only one anchor WLC is proposed at Site A, DMZ zone to provide guest internet access
My customer would like to load balance the guest via the two internet link at Site A and Site B but with the same SSID across all locations. Can it be done since only one anchor at Site A? How about puttting another anchor WLC at Site B, DMZ zone? But how can i establish two EoIP tunnel to two different anchor WLC from a single WiSM?
Thanks for your help
Delon

You can... but you can't control where the traffic will flow. The wlc will determine which DMZ wlc it will use. The wlc will load balance, but traffic in site A might go to site B. I currently have deployed that senerio in multiple client installations....

Corporate responsibility for logging guest Internet access

Hi all
Can anyone tell me what the requirement is in the uk for logging guest Internet access for guest users at my co
Company ? Is it lawful requirement ?

The following documents lists all the supported Databases,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

Restrict Wireless Guest Internet Access

I am implementing a wireless guest solution for Internet access. I would like to restrict these users to Internet access only. I undestand the concept of configuring a seperate vlan for them but how can I restrict them to Internet only. I also have remote campuses that I would like to setup as well. I have an ASA 5520 for my firewall and am using metro ethernet from the main campus to the remote campuses. Thanks for any help.

Hello,
I have found the simplest way of doing this is to apply an access list to the radio sub-interface for the vsitor vlan.
Set the access-list to allow any dhcp requests, deny any to a private network and permit any.
You could do it back at the ASA but there is a chance of the traffic getting onto the network first.
HTH.
Andy.

ASA 5510 Guest Internet Access

I have a subnet for guest network access, both wired and wireless. We have a Netgear ProSafe that is trunked to a Cisco 2901 performing 'Router-on-a-Stick'. For most internal traffic, it all stays behind the ASA. But for guest traffic, I have a route-map that sets the next-hop address as the outside interface of the ASA. The question is, how can I still permit those users to access our internal DNS servers? Do I need any particular NAT translations, exemptions, DNS doctoring, hairpinning, etc.? I have an ACL on the inside interface that permits traffic from the guest networks to our internal DNS servers, and then the next ACL line denies any other traffic from the guest networks to any of our internal networks.
Regards,
Scott

Hello Scott,
Your ASA will need to have a route for both networks
You also will need the following command:
-same-security-traffic permit intra-interface
The thing is that the packets from the guest vlan will go directly to the ASA as its default gateway, then packets will be routed to the Router on stick and finally to the DNS server, the reply will go from the DNS to the Router on stick and then directly to the Guest user.
Nat exemption will look like this:
access-list nonat permit ip 192.168.14.0 255.255.255.0 host 192.168.11.6
access-list nonat permit ip 192.168.14.0 255.255.255.0 host 192.168.11.4
nat (inside) 0 access-list nonat
Please give it a try, also please provide packet tracer
packet-tracer input inside udp 192.168.14.10 1025 192.168.11.4 53
Regards,
Julio
Rate helpful posts

Advice regarding house guest internet access through Airport Express

I would like to set up trouble-free (on my part and my house guests) access to the internet. Any thoughts or suggestions? It seems to me that if folks may have reasonable access to cable/satellite TV and telephone, or what have you, it is also reasonable to make available to them the internet. What is the best way to go about doing this? I have an existing home wireless system using Airport Express (may also work in a Netgear WG614 wireless router). Mostly, I am concerned with the technical aspects but would also like to hear from anyone regarding the legal/social ramifications. Any such solutions must take into account both Windows and Mac environments. Thanks.
17 in. iMac G5 ALS (1.8 GHz) Mac OS X (10.4.5) iMac G3 DV (400 MHz), Airport Express, 3rd gen iPod

Meme,
A nice touch, and one that made me choose one small hotel over another when I used to travel a lot.
I can't give a complete solution, but I can give you bits of info, which others will also do.
One thing that probably is a must, is to set Wireless Isolation. That is that although all the wireless clients can see the internet, they can't see each other. I'm not sure that the AE supports this, I honestly thought it did, but now I can't find it. The Netgear will support it.
Wireless encryption will be a must too, you may even want to make it a "closed network", so that the network does not advertise it's presence. Clients wishing to connect must specify ("key in") the network name and connect. That may be just a little too difficult for some business travellers. Back to wireless encryption, some may say to use some ultra-modern hi-tech secure encryption algorithm to be really safe, but these are enormous long passwords that your clients will have to key. Those with older computers may not support the latest encryption methods. Some may recommend WPA, I'd say WEP (more compatability) and a simple (non-dictionary) password, like "@pple" or "@irPortXPr3ss" or any easy to communicate word(s) with a few letters replaced by vowels or (printable) symbols. It is up to you how often you change the password.

"No internet access" on Guest Wifi

We upgraded our router the other day, we made a backup as well as a txt copy of the config file for copying in various commands to the new router .
We have a Secure wifi for employees and a Guest wifi for visitors. We have a server doing the DHCP(10.27.131.8) for both the secure (10.27.131.0 network) and for the Guest (10.26.131.0 network). The Secure wifi is working as it should be - the Guest however is not. Visitors can connect and get a valid IP address from the 10.26.131.0 network but have no internet access. Everything else has stayed the same - no changes to the AP's.
Again we copied the config from the old to the new with a few minor changes but nothing that should effect the Guest wifi.
I did an ipconfig after connecting to the Guest Wifi and I can get a correct IP address 10.26.131.214, Default GW: 10.26.131.1.
I enclosed the config from my router is anybody could shed some light,
Thanks in advance.
Building configuration...
aaa new-model
aaa authentication login default line local
aaa authentication login vtymethod group tacacs+ line
aaa authentication login conmethod line
aaa authentication login httpmethod group tacacs+ local
aaa authentication enable default enable group tacacs+
aaa authentication ppp default none
aaa authorization config-commands
aaa authorization exec default local group tacacs+ none
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
aaa session-id common
resource policy
ip subnet-zero
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.26.131.1 10.26.131.100
ip dhcp pool guest
   network 10.26.131.0 255.255.255.0
   dns-server 208.67.222.222 208.67.220.220
   default-router 10.26.131.1
   domain-name guest.X.xxx
interface Tunnel3
ip address 172.17.3.2 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 19x.xx.xx.xx
interface Tunnel55
ip address 192.168.66.10 255.255.255.0
ip accounting output-packets
ip accounting access-violations
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 12.xx.xx.xx
interface FastEthernet0/0
ip address 12.xx.xx.xx 255.255.255.248
ip nat outside
ip route-cache flow
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1
description CONNECTION TO SW3
no ip address
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.27.131.254 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
no snmp trap link-status
interface FastEthernet0/1.20
description GUEST NETWORK
encapsulation dot1Q 20
ip address 10.26.131.1 255.255.255.0
ip access-group 101 in
ip helper-address 10.27.131.8
no snmp trap link-status
interface FastEthernet0/1.200
description Phone VLAN
encapsulation dot1Q 200
ip address 10.5.2.254 255.255.255.0
no snmp trap link-status
interface Serial0/0/0
no ip address
shutdown
interface Serial0/2/0
no ip address
shutdown
interface Serial0/3/0
no ip address
shutdown
ip classless
ip route 0.0.0.0 0.0.0.0 12.xx.xx.xx
ip route 10.5.5.0 255.255.255.0 10.5.2.1
ip route 10.10.0.0 255.255.255.0 172.17.3.5
ip route 10.10.200.0 255.255.255.0 172.17.3.5
ip route 10.25.131.0 255.255.255.0 192.168.66.20
ip route 10.27.129.0 255.255.255.0 172.17.3.5
ip route 10.27.130.0 255.255.255.0 172.17.3.5
ip route 140.xx.xx.xx 255.255.0.0 172.17.3.5
ip route 192.168.2.0 255.255.254.0 172.17.3.5
ip route 192.168.99.0 255.255.255.0 172.17.3.5
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 2 interface FastEthernet0/0 overload
access-list 2 permit 10.27.131.0 0.0.0.255
access-list 2 permit 10.25.131.0 0.0.0.255
access-list 2 permit 192.168.66.0 0.0.0.255
access-list 2 permit 10.14.0.0 0.0.0.255
access-list 2 permit 10.5.5.0 0.0.0.255
access-list 2 permit 10.5.2.0 0.0.0.255
access-list 5 deny   10.27.131.123
access-list 5 permit 192.168.2.0 0.0.0.255
access-list 5 permit 10.27.131.0 0.0.0.255
access-list 5 permit any
access-list 101 permit tcp any host 10.27.131.8 eq 67
access-list 101 permit udp any host 10.27.131.8 eq bootps
access-list 101 permit ip 10.26.131.0 0.0.0.255 host 10.14.0.6
access-list 101 deny   ip 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 10.26.131.0 0.0.0.255 any
access-list 102 permit icmp 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 192.168.66.0 0.0.0.255 any
access-list 102 permit ip 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 10.27.131.0 0.0.0.255 any

Hi,
I also apologize for my late answer.
I appears your ACL 101 that filters traffic entering the Fa0/1.20 is not correctly written to allow DHCP requests to be processed by the router. The attempt has been made - but it is not correct. In particular, check out the second entry in the ACL 101:
access-list 101 permit udp any host 10.27.131.8 eq bootps
It allows all DHCP messages that are already targeted to 10.27.131.8, the DHCP server. However, such targeted DHCP messages may be used by clients only after they know who the DHCP server is in the first place. Until then, the requests are targeted to 255.255.255.255 and sourced from 0.0.0.0. Such packets are not allowed by any entry in the ACL 101 and are therefore dropped even before the DHCP Relay Agent can process them. That would explain why your clients actually cannot obtain IP address via DHCP in VLAN 20.
We need to add the following entry immediately before or after the existing second entry in the ACL 101:
access-list 101 permit udp any host 255.255.255.255 eq bootps
You may accomplish this by the following sequence of commands directly pasted into the global configuration:
ip access-list resequence 101 10 10
ip access-list extended 101
15 permit udp any host 255.255.255.255 eq bootps
end
The first line will cause the individual entries of the ACL 101 to be internally numbered, starting with the sequence number 10 and incrementing by 10 for each subsequent entry. The second line enters the ACL 101, treating it as a named ACL, allowing us to use the extended editing features. Finally, the third line starting with the sequence number 15 will cause the entry to be added between the existing first (seq no 10) and second (seq no 20) entry. It must be entered including the sequence number, otherwise the line will be added at the end of the ACL.
Would you mind trying out this modification? The former corrections with the NAT I have described earlier must be applied as well.
Best regards,
Peter

Internet access to the guest system for Host-Only configuration

Hello,
I have a windows host linux guest vBox environment and it's configured as host-only. How can I enable internet access within the guest? I am towards the end of a RAC installation and upon running buildcluster.sh, it says the recommended RPM "oracle-validated" not installed or has unsatisfied dependencies. It seems i have quite a few RPMs need to download and thus prefer to be able to connect to the internet within the guest so i can do it from the Oracle yum server.
Thanks,
Harry

Hi,
this won't work so easiliy with a "Host Only" network.
You either need a bridges network or a NAT network.
Easiest thing probably will be to add another interface (network) to the VM and assigned it as bridged.
Then download/update oracle-validated and remove the interface again.
This way, you don't need to change anything on the server.
Regards
Sebastian

Wireless Guest Internet Only Access

We just got our 4402 WLC with 1131ag access points up and running. We would now like to set up guest access with only internet access. Our vendor has suggested setting up a dmz on our checkpoint firewall and have it do dhcp and then setting up a wlan on our controller for the guest access. My question is: what do I need to do on the switch side to set this up? Is is just as simple as creating a vlan and giving it an ip address in the dmz range? Or is there another way of setting up internet only guest access?
Any suggestions would be appreciated.
Thanks in advance.
Jeff

It depends if all you are wanting to do is Internet-only on you controller. If thats it, then you can place your controller in a dmz. Have a device handout the dhcp information to your clients. Set your controller for layer-3 mode. Have your APs connect to your controller (make sure you have the correct ports allowed through your firewall between the APs and the controller). I would recommend placing the APs on a seperate VLAN than other internal traffic with the appropriate LWAPP options configured in the DHCP scope.
The clients will then associate to the SSID you have setup. They will pull an IP address from the DMZ.
A few years ago on my first LWAPP deployment, I did this setup and it worked perfectly. I would also recommend having the DHCP server in the DMZ assaign an IP address that is not routable in your internal network. That way, if somebody makes a mistake and their is leakage, the traffic can't be routed anywhere since the source IP address of the wireless client isnt routable. You can use this DMZ controller access for Internet only which can also be used by internal people to VPN back to you internal network if you have that permitted.
If however, you are planning to do both direct connection to your internal network and an internet-only connection (two different SSIDs) the best way is to get a small controller for your DMZ (like a 4402-12) and a larger controller for internal (4402-25 or 4404-100). Have your DMZ controller be a guest internet controller that is setup as the guest "anchor". There are lots of docs on the Cisco web site. This solution works great. I use a 4402-12 as a DMZ anchor and have about 20 4404-100s that are anchored to it.

My guests does not get internet access through my guest network

I have created a guest network on my time machine. The problem is that my guests don´t get internet access when they choose the network and type the password. I don´t understand why this is happening? My ordinary network is fully functional.

If you are using 7.6.3 firmware on the TC, the guest network does not actually work in bridge mode.. it looks like it does.. but nope, it doesn't.
Make sure the TC is the main router in the network.

Windows 8.1 Hyper-V, guests have no Internet Access

Hi
I've researched this issue, and have tried any available solutions to no avail..
Here's what I have
Windows 8.1 (clean install) running Hyper-V
Host machine has dynamic IP over Ethernet, with working Internet access.
Within the virtual switch manager, I've created an 'External' network, and have assigned this to the guest VM.
When I boot up the guest VM, it's assigned a valid IP within the DHCP range, valid Gateway, and valid DNS servers. However the network is showing as limited connectivity. I have tried assigning the guest a static IP, but this did not help. I
can access network file shares.
Firewalls are disabled, both guest and host, no internet proxy is being used.
Any ideas to what else I can check?
Thanks

Okay, there are a few things that could be causing your issue, but before I go into those, let's first make sure we are all on the same page here.
First, I'm assuming when you reference the host machine you are referring to the machine that is hosting the Hyper-V service. Please let me know if
this is not the case. Also, which operating system is the guest VM running? Is it also Windows 8.1?
Second, are you attempting to connect this guest VM to its own private network, or to the host’s network? If you are attempting to use the host’s
network connection, you should be able to simply connect to the external switch you created in the hardware configuration section, under ‘Properties’. Also, you will want to make sure the external switch you created is connected to the proper network adapter
under the Virtual Switches section.
Third, what is your overall objective? Do you want to use the host’s network to create a private network for the guest VM? If this is the case, you will want to create
a guest VM with two network adapters. The first network adapter will be connected to the external switch and the second to a private switch. You will then want to configure
Routing and Remote Access so that the guest VM is able to act as a DHCP and DNS server.
If you have screenshots of your settings, this could help us possibly pinpoint the error in configuration as well.
Hope this helps!
Jessica
Windows Outreach Team – IT Pro

Networking problem (internet access)

My host has no internet access, but the VMware guests do. Because the host has no access, the NAT over host doesn't work when I want to access the internet.
Therefore I added a third bridged network card. With this card internet works fine, but the Oracle Cluster doesn't work any more. It seems to get confused by the added card.
What must I do to make Oracle work again? - Or is there another way to access the internet from the guest if I don't want to let the host access it?

My host has no internet access, but the VMware guests do. Because the host has no access, the NAT over host doesn't work when I want to access the internet.
Therefore I added a third bridged network card. With this card internet works fine, but the Oracle Cluster doesn't work any more. It seems to get confused by the added card.
What must I do to make Oracle work again? - Or is there another way to access the internet from the guest if I don't want to let the host access it?

Airport Extreme 802.11AC + 5th Gen and guest network access

I have the current gen Airport Extreme 802.11AC with a 5th Gen extending the network. With this setup, I am unable to login using our guest network setup. I have tried using guest network with a password and one without but its the same results. When a guest logins, it stuck attempting to login with no error messages.
So is it possible to have this configuration and still have guest network access?

Please review what I said originally.......that the guest network function on the AirPort Extreme is designed to work with a simple modem......so the AirPort acts as the main router for the network..
Another way of saying the same thing is that the AirPort needs to be "in charge" of your network for the guest feature to work correctly. The AirPort cannot be in charge if it is connected to another device that is already configured to be the main router on your network.....your Actiontec modem/router.
The Actiontec device combines the functions of a separate modem and a separate router in one package. This type of device is known as a modem/router, or also known as a gateway.
Some folks call a modem/router or a gateway......a modem. So, things can get confusing.
I do not know if it is possible for the Actiontec device that you have to be configured to act as a simple modem.....so the routing functions of the device are completely turned off. (Turning off the wireless on the Actiotec does not turn off the routing function).
If you turn off the wireless on the Actionec, it becomes a modem and a wired router. And that wired router is still in charge of your network.
The guest network feature will not work correctly unless the AirPort is in charge of your network.
My suggestion was for you to ask your Internet Service Provider (ISP), if they could supply you with a simple modem. That is all that you need. You don't need two routers....and the Actiontec that you have now is not allowing the guest feature to work correctly.

Guest Internet Access

Similar Messages

Maybe you are looking for