Guest SSID internet only

Question

                   I am looking for the best practice of securing internet only SSID on controller. Would I use acl on controller for that ssid or on prtinemt interfaces to keep guest traffic from accessing networks that it souldn't?
thanks,
Jerry

Answer 1

The way I did it, I didn't use an anchor controller...forgot to mention that.  I only have one 2504 controller.  Of course setting up an anchor is better if you've got one.
One question:
The guest traffic will be encapsulated in CAPWAP, thus putting the guest data onto the internal vlan which the APs use to communicate with the WLC.  The WLC then strips the CAPWAP header and process the guest traffic appropriately, forwarding it to the appropriate gateway as necessary.  This being the case, the guest traffic is making its way onto the internal LAN while being sent from the AP to the WLC.  Given that the guest traffic is encapsulated in CAPWAP, I don't think this poses a security risk (allowing the guest traffic onto the internal vlan via CAPWAP), does it?
I forgot also to mention that I have a dedicated vlan for WLC <--> AP traffic.  ACLs are applied to this vlan so that no other traffic is allowed in or out.
In absense of an anchor controller, this is the best way I can see to do it.
I hope the above question is clear.