Guest Wireless Access in Bridged Mode e4200v1

I have an e4200v1 in bridge mode (LAN IP 192.168.1.2) connected via its WAN port to a LAN port on the primary router at 192.168.1.1.
Guest Wireless works perfectly in Ver. 1.0.04 build 11 but not in Ver. 1.0..05 Build 7.
ANy ideas?

I've tried searching the forums for the same concern. I found the following:
http://homecommunity.cisco.com/t5/Wireless-Routers/Guest-network-doesn-t-work-in-bridge-mode-on-E420... - the user herot80 provided steps on how did he the guest network working on his setup.
http://homecommunity.cisco.com/t5/Wireless-Routers/Linksys-EA4500-Bridged-Network-amp-Guest-Wireless... - user counsil suggested to make sure that NAT is on before setting the router to a bridge mode for the guest network to work.

Similar Messages

How can I set up a guest access point with a Time Capsule and an Airport Extreme? I am using a Telus router with the Time Capsule used as a wireless access point (bridge mode). I don't want the guest access point to have access to my network.

How can I set up a guest access point with a Time Capsule and an Airport Extreme? I am using a Telus router with the Time Capsule used as a wireless access point (bridge mode). I don't want the guest access point to have access to my network.

The Guest Network function of the Time Capsule and AirPort Extreme cannot be enabled when the device is in Bridge Mode. Unfortunately, with another router...the Telus...upstream on your network, Bridge Mode is indicated as the correct setting for all other routers on the network.
If you can replace the Telus gateway with a simple modem (that performs no routing functions), you should be able to configure either the Time Capsule or the AirPort Extreme....whichever is connected to the modem....to provide a Guest Network.

Guest access in bridge mode

I want to set up a secure wireless network in our small office that will also allow clients to access the internet while in our waiting area. I also want to maintain our current wired network, which is connected to the internet through a Nortel router, connected to a DSL modem. Where would the Airport extreme be installed? - i.e., upstream or downstream from the router? Also, looking over Apple's network documentation, it appears that the Airport Extreme would be in Bridge mode when configured on an existing ethernet network with router, but the documentation is clear on the issue of setting up guest access in this kind of configuration.
In case you have not guessed, I am not an IT guy, so will be grateful for any helpful suggestions

Blind Lemon wrote:
I want to set up a secure wireless network in our small office that will also allow clients to access the internet while in our waiting area. I also want to maintain our current wired network, which is connected to the internet through a Nortel router, connected to a DSL modem. Where would the Airport extreme be installed? - i.e., upstream or downstream from the router? Also, looking over Apple's network documentation, it appears that the Airport Extreme would be in Bridge mode when configured on an existing ethernet network with router, but the documentation is clear on the issue of setting up guest access in this kind of configuration.
Guest access and bridge mode are incompatible on AirPort base stations. I'd connect an AirPort Extreme to your DSL modem, connect your wired network connections to the Ethernet ports of the AirPort Extreme, and take the Nortel router out of service. Depending on how many wired connections you need, you may also need an Ethernet switch. Besides the WAN port, an AirPort Extreme only has three available Ethernet ports.

Setting up webauth for guest wireless access

Hi there,
I'm trying to set up guest wireless access. having no experience with this at all, I'm beginning to struggle.
Equipment:
2x 3850 stacked and acting as one switch running 03.06.00E
4x 1602E AP's registered to the WLC running on the 3850
The infrastructure is sound and corporate wireless access works ok.
I need a config that allows a guest user to connect to the guest SSID, DHCP an address, then when they open a browser, they are automatically redirected to a splash screen for them to log on. Once they log on with the supplied username and password they are then forwarded to whatever site it is they wish to go to; So far my config looks like this (removed unnecessary parts for brevity);
Building configuration...
user-name test
creation-time 1414684496
privilege 0
password 7 051F031C35
type network-user description test guest-user lifetime year 0 month 0 day 0 hour 23 minute 59 second 4
aaa new-model
aaa authentication login aaa_guest_webauth local
aaa authentication login local_login local
aaa authorization exec local_authorise local
aaa authorization network guest_authorisation local
aaa authorization credential-download default local
aaa session-id common
switch 1 provision ws-c3850-24t
switch 2 provision ws-c3850-24t
service-template webauth-global-inactive
inactivity-timer 3600
service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
hw-switch switch 2 logging onboard message level 3
parameter-map type webauth global
virtual-ip ipv4 1.2.3.4
parameter-map type webauth guest-webauth
type webauth
redirect on-success http://www.google.com
banner text ^CC test text test ^C
custom-page login device flash-1:login.html
custom-page failure device flash-1:failed.html
class-map match-any non-client-nrt-class
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
interface VlanXXX
description "Guest-Access-VLAN"
ip address 10.x.x.126 255.255.255.128
ip helper-address x.x.x.x
ip helper-address x.x.x.x
line vty 0 4
exec-timeout 7 0
authorization exec local_authorise
login authentication local_login
transport input ssh
line vty 5 15
exec-timeout 7 0
authorization exec local_authorise
login authentication local_login
transport input ssh
wsma agent exec
profile httplistener
profile httpslistener
wsma agent config
profile httplistener
profile httpslistener
wsma agent filesys
profile httplistener
profile httpslistener
wsma agent notify
profile httplistener
profile httpslistener
wsma profile listener httplistener
transport http
wsma profile listener httpslistener
transport https
wireless mobility controller
wlan Wireless-Guest-Access 24 wireless-guest
client vlan Guest-Access-VLAN
ip access-group GUEST-ACCESS
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
security web-auth
security web-auth authentication-list aaa_guest_webauth
security web-auth parameter-map guest-webauth
session-timeout 1800
no shutdown
ap country GB
ap group default-group
ap group BUS-AP-Group
wlan Wireless-Corporate-Access
vlan BUS-CORP-DATA-VLAN
wlan Wireless-Guest-Access
vlan Guest-Access-VLAN
end
I carried out a wireshark trace and can see the dhcp ok, then see DNS queries to the DNS name serever and the replies, followed by a TCP SYN to the resolved IP of the website requested - but that's it, there is no SYN ACK reply or redirect to the login page which i have placed on the flash and specified under 'custom-page login'
I am under the impression that the way this should work is as follows;
1. Client connects to SSID and carries out DHCP DORA and is assigned an IP address
2. open browser on client and carry out name resolution
3. once name is resolved, carry TCP three way handshake with requested site (e.g. google)
4. once three way handshake is completed client carries out an HTTP GET request
5. WLC holds the response and redirects to the login page
6. on successful login, original requested page is forwarded to client.
I can't seem to get a response - even if I remove the ACL.
Am i heading in the right direction or am I trying to achieve something which is not possible with my setup?
Cheers

also, forgot to say, make sure your files are preceeded with webauth for your html and js and web_auth for image files
38725 -rw- 4265 Nov 4 2014 12:21:28 +00:00 webauth_login.html
38726 -rw- 6937 Nov 4 2014 12:11:03 +00:00 webauth_aup.html
38727 -rw- 1356 Nov 4 2014 12:11:30 +00:00 webauth_logout.html
38728 -rw- 662 Nov 4 2014 12:11:43 +00:00 webauth_failed.html
38729 -rw- 318 Nov 4 2014 12:11:58 +00:00 webauth_loginscript.js
38731 -rw- 82940 Nov 4 2014 12:12:28 +00:00 web_auth_image.jpg
CORE-SW01#sho run | s param
parameter-map type webauth global
type webauth
virtual-ip ipv4 1.1.1.1
custom-page login device flash:webauth_login.html
custom-page failure device flash:webauth_failed.html
parameter-map type webauth guest-webauth
type webauth
custom-page login device flash:webauth_login.html
custom-page failure device flash:webauth_failed.html
security web-auth parameter-map guest-webauth
CORE-SW01#

Guest Wireless access over WAN

Hello Everyone,
We have around 45 remote location , all are connected with GRE Tunnels.
44 location have there own WLC which are managed by NCS and ISE in HQ , All 44 location have Wireless access for Guest and INternal Staff.
Now my Question is :
One location(45th) have only 10 users and I dont want to put a WLC there.
How can I provide the Guest wireless access on this location over WAN from HQ.
We can buy APs.
Please give me some ideas to solve this problem.
Here I am attaching my default plan :
Thanks

You just configure the access point in FlexConnect mode and then on the guest SSID you would central switch the WLAN. Central switching tunnels back traffic to the WLC and local switching drops traffic off at the local site. Here are some guides to look at.
https://supportforums.cisco.com/docs/DOC-24082
http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml
Sent from Cisco Technical Support iPhone App

E4200 as a Access Point/Bridge Mode

I have spent most of the weekend trying to get this router to act as a proper Access Point.
Has any got this to work correctly?
When it does work (Stay connected) speeds and latency are rotten. If I go back to Routing Mode this thing kicks butt, but I isolate all devices attached to a different subnet and trying to set up proper routes has proved imposable.
Firmware 1.0.2 r 13
The online help stated to connect to the "internet interface" when in Bridge Mode DHCP Server Is not broadcasting to on the wireless or wired interfaces.
If I used the wired interface as the uplink I can broadcast the DHCP to any device on wired but again nothing to the Wireless.
When I "Show Routing Table" I see two static routes pointing to the ATT router for the Wired/Wireless Interfaces.....
0.0.0.0 255.255.255.0 (my Gateway) Wired/Wireless
(my Gateway) 255.255.255.0 0.0.0. Wired/Wireless
Why??
AP mode should only be working in Broadcast.
By connecting the Wired Interfaces alone up to my switched network should not use the router at all.
If you force all traffic to my router all traffic has to be inspected by the firewall
You create a bottleneck my router interface is 10/100.
ATT 2 Wire Gateway/Router with pinholes. 10/100/1000 Non managed 24 port Switch Network. Server infrastructure serving DNS/DHCP.
I decided to buy this after reading it offered Bridge/Access Point mode instead of getting the WAP610 because I wanted to have the option to change to routing mode or AP mode.
Since my ATT Uverse Router Wireless is “g” it takes forever to transfer files to and from my servers.

OK If this helps... I am running a SOHO
2Wire DSL Router with DHCP Off Assigned 192.168.100.1 as the Router Gateway IP. NAT Enabled All firewall is being handled via 2Wire. Currently 2Wire WiFi is disabled. For the Linksys E4200
2wire 10/100 interface up-linked into my d-link 24 port 10/100/1000 Layer 2 unmanaged switch.
DHCP and DNS Servers on d-link switch
VOIP on d-link switch
Testing Results WAN Interface Bridge
E4200 up-linked via 10/100/1000 Internet Interface to d-link network switch.
E4200 Internet Interface DHCP assigned using MAC Reserved DHCP 192.168.100.22.
E4200 in Bridge Mode
Devices connected to 4X E4200 Gig Ports do not receive DHCP broadcast IP Address
Device Connected to E4200 WiFi do not receive DHCP BroadcastIP Address
Assign Static IP to my laptop WiFi in the 192.168.100.X range will establish communication but HUGE latency and poor speeds for any traffic internet or internally to any of my servers.
At times the connection gets lost.
In this configuration I get the above stated Route Tables.
If this is layer 2 compliant it should be handing all local subnet traffic via MAC instead of routing.
I have not taken the time to attempt to reconfigure my 2Wire to go into DMZ Plus mode and allow the linksys to handle all routing, but from previous attempt with my wrt54 it did not go well. I accepted the slow 2Wire WiFi speeds.
It is now getting to the point I am looking for better WiFi to local LAN speeds , I also am looking to do Layer 2 and bypass Routing if I can.
The WAP160 has a 10/100 interface. I prefer gig

Wireless works in Bridge mode but refuses in Share a Public IP

This might seem like the easiest problem, but after searching the forum for ages I am still clueless.
I connect to the internet by plugging the ethernet cable straight into the wall. Living in a student flat connecting through the uni's network. MAC-address is not required to log on. In order to access the internet however, username and password is required at a greeting/log on page.
Things were working fine with multiple laptops and streaming iTunes, having the AE setup to share a public ip, until yesterday when iTunes could no longer find the AE. After resetting the AE (plug out, plug in) internet could no longer be accessed. The log on page can't be found, it just times out.
I've been trying a few different setups and the only one that works is using the AE in bridge mode. I want to have it set up to share a public IP but nothing seems to work. Although the router gets an IP assigned and so does the laptop (the AE seems to communicate with the uni network, and the laptop communicates with the AE) internet can't be accessed by the laptop.
Any ideas? If I missed providing some vital info please let me know!
Thanks!

Welcome to the discussions!
I've been trying a few different setups and the only one that works is using the AE in bridge mode. I want to have it set up to share a public IP but nothing seems to work. Although the router gets an IP assigned and so does the laptop (the AE seems to communicate with the uni network, and the laptop communicates with the AE) internet can't be accessed by the laptop.
From your information, the main router at the school's network has been configured to only accept a certain type of connection. Bridge mode is the correct setting for the AirPort Express in this type of setup because you have another router (the school's router) ahead of your device.
Unless you can convince the IT guys there at the school to modify things to allow you to connect using "share a public IP address", I'm afraid there is nothing more than can be done.
In more technical terms, the school's router will not allow another device to handle DHCP on the network.
Message was edited by: Bob Timmons

Web Based Registration for Guest Wireless Access

I just started a project to make a guest wireless network available at every site in my enterprise. Guest wireless networks are currently available at some sites. Two key goals of this project is to enable WPA/WPA2 encryption and to develop a web based registration/autentication solution. All of the sites have a mixture of 1230, 1240, and 1250 autonomous access points. What do I need to do/get in order to make this happen?

You should get a WLC and upgrade the 1240 and 1250 and replace the 1230's if they are in remote sites.
The WLC has a Webauth feature that is great. You can define users on the WLC also if you wish.
Guest access should always be open authentication with the use of a Webauth page. This makes it easy and you won't have to help manage guest access. Autonomous ap's and to have a splash page will require a 3rd party software or you can use a Cisco NAC guest server.
Search for Cisco Wireless Guest Access or Webauth and you will see many docs on this type of setup.
Sent from Cisco Technical Support iPhone App

Setting up 'guest' wireless access on a wireless router attached to our LAN

My organization purchased a Cisco Wireless-N Gigabit Security Router and asked me to configure it so that guests could access the internet (through our LAN) but not any of our LAN resources. According to the packaging, there is a "built-in wireless access point" with "secure guest access" but I cannot find the instructions on how to configure it anywhere in the 133-page administrator's guide that came with the unit. I thought I was familiar with WAP's even though I have never set one up from scratch before, and now I have a special one to set up. Any suggestions on how I get started? -Marty

Arthur,
Thank you for responding to my inquiry. I opened a case, and Small Business tech support told me what to do. What I needed to do was to establish a new SSID and a new VLAN, and disable security, enable VLAN isolation and allow it to broadcast. To my surprise, it allowed anyone with connect but only traverse our network to get to the internet w/o seeing any of our LAN resources. Which was exactly our goal.
Marty

Cisco Guest Wireless Access Solution - Local Printing

Hi,
Does Cisco have a solution that provides printing for a guest WLAN. Cisco Guest wireless deployment solutions recommend terminating the guest WLAN on an anchor controller in the DMZ which causes issues when needed to print locally as the print traffic will need to traverse the DMZ anchor controller causing excessive WAN link usage.
Is there a better solution to enable a guest WLAN to print locally?

FlexConnect with Split tunneling may work.
Read about this feature & see how that can be used in your branch setup. Here is the Ciscolive presentation slides the above came from.
BRKEWN-2016: Architecting Network for Branch Offices with Cisco Unified Wireless
HTH
Rasika
**** Pls rate all useful responses ****

E4200 Bridge Mode + Guest Access?

Hi,
I'm trying to set up my E4200 in "Bridge Mode," but want to enable a few things in the wireless settings, such as:
a) choosing SSIDs and network keys,
b) enable Guest Access
I've been able to get things working without too much hassle:
* factory reset
* set wireless SSIDs and network keys
* enable guess access and set password
* turn on bridge mode
Everything is basically fine, except that when the device goes into bridge mode it seems that it shuts off *all* web UI. This kind of makes sense, but do I actually understand that correcty? (Or have I simply not found the right connection method?)
If so, it leads to a couple follow-on questions:
a) How do I disable Bridge Mode if I want to change any settings? (Is the answer just 'factory reset'?)
b) Can Guest Access mode work in Bridge Mode?
So far, I have not been successful in getting the device to display the login page for Guest Access. I'm not sure if that's a config problem with Guest Access or if that just doesn't work in Bridge Mode.
Any tips/advice appreciated.
thx

Dude buddy. This is your post:
gv
Expert
Posts: 11,833
Registered: 07-16-2006
0
Re: E4200 Guest Network Not Working [ Edited ]
06-24-2011 10:40 AM - last edited on 06-24-2011 10:41 AM
It's not possible to use guest access in bridge mode. Guest access is only possible when the E4200 operates as router. In bridge mode any wireless network goes directly into the same LAN. Guest separation would not be possible.
Also don't disable the SSID broadcast.
http://homecommunity.cisco.com/t5/Wireless-Routers/E4200-Guest-Network-Not-Working/td-p/406345/highl...
What I'm saying is that it is possible and that I am doing just that on our LAN here at work.
You pegged me on the linksys devices not allowing higher subnets. Alas, I am used to using DD-WRT and Tomato for years now (where you can use any subnet mask) and took for granted that I have not seen a stock linksys GUI in a long time. However, in bridge mode on the E4200 you are able to set subnet masks as you wish...

E4200 in bridge mode

Hi,
The latest firmware seems to support bridge mode. Does it mean the router can connect to another router wirelessly in the bridge mode?
Solved!
Go to Solution.

No, it bridges the LAN and WAN ports allowing E4200 to downgrade to an access point.
I don't work for Cisco. I'm just here to help.

Web Page for Guest Wireless

Hi.
I was wondering if someone could help me with the easiest way to set up a Web Page to control Guest Wireless access on Cisco AP 1130AG.
I was using PEAP and Dot1x to Active Directory but the messing around required on some clients (namely XP and Vista) means it is not ideal for random and unexpected guests.
How can I set up an Open Authentication method (or whatever I need) that then defaults to a web page or logon page for access to the network itself? I have seen this in other companies so it must be do-able.
Just for information a standard WPA2 key for the SSID is insufficient as we want a logon page and user credentials that are changeable.
I hope someone can help.

Are you using the AP with a lightweight controller, or standalone (autonomous)?
The lightweight controllers have this capability. Standalone APs do not.

Monitoring guest wireless

Hi experts, I have a requirement by a customer that they will want to monitor the guest wireless access. Currently, we are proposing a Cisco Wireless Controller 5508 together with APs and the setup would be a dedicated VLAN for guest. I am wondering if Cisco ISE together with Cisco MSE would be sufficient?
Stuff to monitor and log are:
1. Guest username (I guess this would be self sponsored)
2. Company name
3. Websites accessed
4. Time, date and duration.
5. Logs are to be kept for 3 months at least.
Are there any cisco solutions for this?

Hi Marcus,
A WLC and ISE with Base Licenses will do most of what you need, but you will also need an ASA to capture the URLs visited. The ASA will forward the URL info off to ISE via Syslog so you can merge the ISE and URL logs in to one place.
Although this will tick your boxes and is an end-to-end Cisco solution, I wouldn't say it's a great one. Instead of ASA and Syslog, if you have WebSense (etc), you may be better off using that with WCCPv2 from a Cisco Router/ASA. This would allow you to perform transparent URL logging and filtering, and you can actually search the logs in a useful way.
Richard
Sent from Cisco Technical Support iPad App

E4200/E3200 in bridge mode...Guest access works, but does not roam between routers...any ideas?

I have installed wireless in my church...main router is E4200 in the office set up as follows:
IP: 192.168.0.1
Subnet: 255.255.255.0
DHCP enabled (Range = 192.168.0.4-192.168.0.103)
Guest network enabled
Static DNS (for content filtering)
NAT: Enabled
Second router E3200 (in bridge mode) - connected LAN to WAN
IP: 192.168.0.2
Subnet: 255.255.255.0
Guest Network enabled
DHCP (obviously disabled)
Static DNS (for content filtering)
NAT: Enabled
Third router E3200 (in bridge mode) - Connected LAN to WAN
IP 192.168.0.3
Subnet: 255.255.255.0
Guest network enabled
DHCP (obviously disabled)
Static DNS (for content filtering)
NAT: Enabled
The 2 routers in Bridge mode are connected to a 16-port unmanaged switch (with other PCs, etc.), which is then plugged into the main router in Port 1.
SSIDs on all 3 routers are exactly the same for both main and Guest networks.
The main network works flawlessly. The router in the office hands out IPs in the 192.168.0.XX range and you can wander throughout the church and maintain a persistent Internet connection. File and print access works fine too from anywhere in the building.
For the Guest network, you can set up a laptop next to each router, obtain an IP address, reach the logon page and surf the Internet without issue. So, the Guest Network works fine from each router.
However, if you wander around the church while on the Guest network (such as with a smart phone), the following happens:
-On either of the E3200 routers (in bridge mode) you get the login page as you wander into the range of each router. I would have thought that if you logged in once, you would be good to go.
-You get a different IP from each router. On the E3200's in Bridge mode, you get a 192.168.33.XX address. Additionally, the gateway is 192.168.33.1. On the E4200 (main router) you get a 192.168.3.XX IP and a gateway of 192.168.3.1.
-As a result of getting different IPs, the smart phone becomes confused and generally won't connect to the Internet.
So, it looks like each router maintains a separate list of who has entered the correct password to get onto the Guest network. Additionally, it appears as if each of the 2 routers, supposedly in Bridge mode, is still handing out IP addresses on the Guest Network, rather than deferring to the router in the office like they do for the main network.
I have seen a lot of postings about how to put routers into Bridge mode and problems with the Guest Network, but posts that I've seen point to the Guest network not working at all, as opposed to this issue where it works; the bridged routers, though, continue to like to hand out IP addresses on it, making wandering around the church while connected to the Internet not possible while connected to the Guest network.
Anyone else experience as similar situation? Any possible solutions out there?
Thanks!
-Gil
Solved!
Go to Solution.

I do understand what you were trying to do here since you would like to have only 2 SSIDs (main & guest) for perhaps easy connectivity. The reason why you were not having problems getting online wirelessly when you were connected to the main network it’s because the computer was connected to only one DHCP server since the 2 bridge routers were just acting as a switch or a passthrough device. Now with guest network access it is a different scenario, a guest network is a virtual network meaning to say it’s like your having another router embedded on your router. Since it is a virtual network, then it does not follow the parameters of the main network, hence even if the router was set to bridge mode those routers will still have their own ip address of either 192.168.33.1 or 192.168.3.1.

Guest Wireless Access in Bridged Mode e4200v1

Similar Messages

Maybe you are looking for