Open Guest Network and DHCP utilisation

For guests to be able to easily access our wireless network, the Layer 2 security is Open, with Web Authentication implemented at Layer 3.
The problem I have is with having no layer 2 security (open), is that my dhcp pool is utilised by devices that may never authenticate. It becomes more of a problem if the DHCP pool is associated with DMZ Public addresses...
Is there anyway of moving the client to a different DHCP pool after web authentication? (ie. from a Private pool to Public pool).
I can see from the documentation that Dynamic VLAN assignment is not possible with web authentication :(

In the case of DHCP, a DHCP server must be available locally and must be able to provide the IP address for the access point at bootup.
http://www.cisco.com/en/US/docs/wireless/wcs/4.0/configuration/guide/wschreap.html

Similar Messages

Lost my guest network and VOIP is no longer....

Hello peeps,
So, this is what I DID have going on (sorry for any incorrect terminogly, I'm not overly techi)..
Centurylink Lynx 220 modem, 3rd gen TC linked to that and from the TC I HAD my VOIP (voice over internet phone?) working just fine. 2 wireless networks, one as the household main and a guest network for......... well, guests lol..
I have been spending a massive amount of time on the phone with centurylink just of late, we pay for 8meg downloads butwhen doing speed tests we were lucky to get 1meg. So, we got a new modem....
and this is what I have NOW....
Westell 7500 Modem, 3rd gen TC linked to that, bloody VOIP is NOT working, LOST my GUEST network and for love or money I can't add another one, that option seems to have completely gone AWOL.....
On the plus side, speed test now shows 7meg of download speed..
Any idea on what has changed? other than the modem change?? could that of made that difference? Any idea on how to get my life back??
We love the option of the guest network as we can turn it on and off for my Son.. Good boy = ON Bad boy = OFF haa haaa haaa how I love that power
Any info would be great.. Thank you

Guest network apparently.. (I haven't tested) does not work in bridge mode on the TC.
https://discussions.apple.com/message/12853944#12853944
As that is the case you must run the TC as a router. Update to latest firmware and latest utility if not already maybe a help.. or a hinderance if you are already there.. visa versa .. go backwards.. Apple don't get them right all the time.
Secondly the modem should be in bridge and using PPPoE client on the TC so it is a full router. This may solve the voip issue as well since your modem may not be setup correctly for voip.

Using an airport extreme in both bridged mode and guest network with DHCP

I currently use a third-generation airport extreme in bridge mode to connect my various Mac servers To the Internet. I'm using bridge mode on the AirPort Extreme because I have up to five static IP address (only using three now) I am currently not using the wireless network, and none of the servers are serving DHCP. I am looking at the Newer airport extreme with guest network Wi-Fi. My question is, does the new airport extreme base station support bridge- mode for any devices and host DHCP for the guest network connecting wirelessly to the base station?

The AirPort Extreme cannot be in Bridge Mode and support a Guest Network.
The AirPort must be configured to provide DHCP and NAT services if you want to enable the Guest Network function.
If you really do have a 3rd Gen AirPort Extreme, it will support the Guest Network feature if you connect the AirPort directly to a simple modem.....not a modem/router or gateway type of devices.......and configure the AirPort to provide DHCP and NAT services for the network.

WRT1900AC - WPA2 on Guest Network and Setting Domain Name

I'm configuring a new WRT1900AC (version 1) and have a couple of questions. The first should be easy, on the Connectivity -> Internet Settings page on the right side under the heading Optional the Domain Name (provided via the DHCP server, Comcast in this case) is displayed, but I cannot change it. How do I set the Domain Name to reflect my local domain? The second question is a bit more daunting. I have two main wifi segments (one each on 2.4Ghz and 5Ghz) that are each secured by WPA2. They work great so far. I also have two Guest wifi segments (one each on 2.4Ghz and 5Ghz), I cannot figure out how to secure these with WPA2. You can set a passwword for each of the Guest wifi segments, and instruct users to open a web browser after connecting and enter this password, but that's not a secure connection. Please tell me there is a way to secure the Guest network via WPA2, nobody wants to use an insecure internet connection in this day and age...... -MC

That's exactly why you want the connection encrypted, so EVERYTHING you send is encrypted and not sniffable. The intended use of this Guest network is for renters at a condo resort, who will likely be doing banking and the like while on vacation. If we only provide an open/unencrypted network for them they can't (or at least shouldn't) use it. I have a Netgear R7500 in place right now, it doesn't have any of these problems (e.g. you can specify the domain name even on with a dynamic WAN IP, and all 4 network segments are WPA2 encrypted). Unfortunately, it's totally unreliable - the 4 network segments randomely disappear and stop working all the time, and the signal range is poor. I "downgraded" to this 1900AC because this router has a better reputation for stability and range (and indeed, I've been testing it for several days now and stability and range seem to be its strong points, not a single problem so far), but these firmware decisions by Linksys are forcing me to reconsider this router. -MC

Guest network and multiple VLANs

Hello all,
I have installed a pair of 5508 controllers in our network. One controller sits inside the network and APs are configured to associate with that controller. The second controller sits on a DMZ interface off the ASA. I have a guest network configured and it works great. I would like to configure additional guest networks at remote locations. Each guest WLAN will have it's own SSID. Is it possible to map all of these to the same VLAN? Or do I need a seperate VLAN and subnet for each SSID.
Thanks

Scott,
Thanks for the reply. I have created different SSIDs and mapped them to the same VLAN. Everything looks good but I'm getting some strange behaviors on the new SSIDs. It appears that users don't authenticate but I've verified the credentials quite a few times. I wanted to make sure that you could map multiple SSIDs to the same VLAN before I continued troubleshooting.

HOW TO CONFIGURE GUEST NETWORK AND LIMITE BANDWIDTH

Dear all,
Please help me how to configure internet access rule and limited the bandwidth for guest network via TMG Forefront 2010.
Thanks you & best regards,
Hung Viet

Hi，
First you can create the new network set which is mapped to guest subnet, after that you can create access rule for this network set.
If you want to control bandwidth, you may need 3-party tool like this:http://www.bsplitter.com/
Best Regards
Quan Gu

Anchor Guest controller and DHCP configuration

I checked the cisco documentation about the DHCP configuration but I´m not 100%sure which DHCP server address I must use.
I used as example the scope 10.240.97.0/24 for our Guest Users. In this range are the DHCP scope and the Guest interface configured. For the management I used as example the range 10.240.96.0/24.Now I configured our Guest WLC and I insert on the Guest interface as Primary DHCP address the Guest interface address. After I applied I got the message I can´t use this DHCP address. Now I checked the cisco and found following description:
“If DHCP services are to be implemented locally on the anchor controller, populate the primary DHCP server field with the management IP address of the controller"
Means it now I must insert as the IP for the Primary DHCP Server on the Guest interface the IP from the management
Interface and the controller will then forward the traffic to the internal DHCP scope on the Guest subnet and wil sent it back ?
( DHCP proxy is on the Guest WLC enabled ) .
Thanks
Al

For Anchor you can use either internal or external dhcp server.
Means it now I must insert as the IP for the Primary DHCP Server on the Guest interface the IP from the management
Interface and the controller will then forward the traffic to the internal DHCP scope on the Guest subnet and wil sent it back ?
Yes. WLC forwards the unicast dhcp req to management ip for guest interface. All cpu generated traffic by default uses management interface as source address i.e., snmp, radius, ping...
Is your question whether you need routing between guest and management interface.
No, routing is not required in this case bcoz the interface residing on WLC's management. Also for proxy it uses the virtual ip address for dhcp instead of actual dhcp ip. And only wireless client can get ip from WLC's internal dhcp server.
If you're using dhcp proxy on wlc and having external dhcp server on different vlan then yes you need routing between the two vlans.

Guest Network and iTunes DJ

Is it possible for users connected to the guest network to use iTunes DJ for an iTunes library which is on a Mac connected to the main network?

The MAC address filtering is for the main wireless network and not for the guest network.
The guest network is different from your private wireless network. This is very convenient especially if you always have guests in your home who would like to access the Internet.
When guests connect to the Guest network, they can connect to the Internet but will not have access to computers and devices which are connected to your Valet or Linksys Wireless-N Router. The Guest network is a virtual network within your private network.
The Guest network operates on a different IP address range (192.168.33.x). This allows your guests to connect to the Internet without becoming a part of your private network.
The guest will need the password to the network if they want to access the Internet.

Guest network and bridge mode

Hi,
my question is, why my guest network doesn't works, if my TimeCapsule works in the bridge mode?
Someone an idea?
Thanks
Albrun

From the latest airport utility and firmware it does work.
I run the TC in bridge and setup the guest to try it.. seems to work for me.
I know there are other issues with using these .. perhaps that is what you mean.. but it does work.

E4200: guest networking and MAC filter

Hi there,
I have my e4200 setup with guest networking enabled and also MAC filtering. Somehow i was epxecting MAC filtering not to be applied to guest wireless network but it appears to be so.
Can anybody please confirm if this is the case and if there's a workaround?
Solved!
Go to Solution.

You are correct. MAC filtering is universal in the router. There is no workaround besides not using it.

Guest networking and mac filtering

I have a dual band airport extreme that I've purposfully kept at an old firmware revision because I have mac filtering enabled and also want to have guest network enabled. Somewhere around version 7.5 a bug was introduced that applied the mac filtering to both the private and guest SSID's. I found a number of posts from back then about it, but can anyone tell me if it has since been corrected in the more recent releases?
Thanks
Matt

Somewhere around version 7.5 a bug was introduced that applied the mac filtering to both the private and guest SSID's. I found a number of posts from back then about it, but can anyone tell me if it has since been corrected in the more recent releases?
No. For what it's worth, Apple Support does not call it a "bug". They call it a "feature".

Wireless and guest network and HREAP

Hi,
I have inherited a wireless infrastructure which comprises of a head office with WCS and WLC plus LWAPP access points.
There is a sub office in another town who wishes to deploy a wireless infrastrucure and it struck me that as they only want to deploy a couple of AP's that HREAP would be good to use in this senario.
However they want to also use the guest wireless network that we have in the head office but I dont want their guest traffic to come to our DSL modem that we have set up for the HO guest wireless. The two offices are connected via an MPLS link which doesnt need anymore traffic on it.
Is there a way of configuring the HREAP and the WLC and WCS so that the sub office breaks out locally for guest and yet the lobby admin at HO can control the password?
Many thanks,

Hi Nell,
the feature you are looking for is "H-REAP local switching".
So you can set the remote AP to H-REAP mode (which optimizes it for "behind a WAN link") and from there you can set several ssids as "local switching".
this means that everything about the authentication phase is handled by WLC but after authentication, the traffic is dropped locally at the AP and doesn't transit through the WLC.
The guest SSID has to be enabled for local switching and then, on the H-REAP APs, go in the AP configuration (from WLC "wireless" tab, then click on ap) and in the hreap tab, you can configure the vlan where the guest traffic will be dropped on the remote site. It must be a vlan that exists on the remote site and users will get a DHCP address on that vlan.
Regards,
Nicolas

Guest LAN and DHCP Options not passing through

Managed to get the Guest LAN up and running for wired clients and all's working well. Users are sat behind a proxy and if I force the use of a appropriate wpad file I can get the WLC auth to happen and then push off to the proxy.
I'm trying to use option 252 in DHCP to present the WPAD url. Only issue that happens is that while the DHCP server on the egress interface is handing out addresses to clients on the ingress interface correctly, the WLC doesn't appear to be handing through the option 252 I have set in DHCP. I've used network monitor to see what the dhcp request process is dishing out in terms of options, and all look good if I'm not behind the WLC.
Anyone know if theres a limitation on the WLC that prevents DHCP options being passed through to the guest LAN?
TIA

When configured as a DHCP server, some of the firewalls do not support DHCP requests from a relay agent. The WLC is a relay agent for the client. The firewall configured as a DHCP server ignores these requests. Clients must be directly connected to the firewall and cannot send requests through another relay agent or router. The firewall can work as a simple DHCP server for internal hosts that are directly connected to it. This allows the firewall to maintain its table based on the MAC addresses that are directly connected and that it can see. This is why an attempt to assign addresses from a DHCP relay are not available and the packets are discarded. PIX Firewall has this limitation.
For more information please refer to the link-http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008070ba8f.shtml

Guest Network and MAC

Is there any way to set up a guest wireless network with a on/off schedual on my airport extreme.
Is there any parental controls that can be set up as a "per computer" basis (It would just be on one computer connected wirelessly and it is running xp home)
How do I set it up to only accept certain MAC addresses.

Yes. It says so here.

WRT120N on non-default network and DHCP problem

Hello,
I have setup the WRT120N on my network with an address like 192.168.3.X, the problem is that I cannot setup the DHCP server to serve on this network, it is fixed on the 192.168.1.X.
Is there a way to change this or I really need to setup my network around this router?
Thanks
Ivan

These settings are not possible. You cannot use the same IP subnet on the internet connection and the LAN. Routing happens based on IP addresses and subnet masks. 192.168.3.* addresses are on the WAN and the LAN side. How is the router supposed to know whether it should route an IP like 192.168.3.7 to the WAN side or the LAN side?
Actually the router should not allow you to set up this. Can you press Save settings with these settings and it is accepted? That would be a firmware bug. The LAN address should never be accepted with a internet address you have set.
Your settings suggest you don't want to use the WRT as router but as wireless access point and ethernet switch to extend your existing LAN. If that's the case, the correct setup would be to switch the internet connection type back to Automatic/DHCP. Leave the LAN IP address as it is or set it to 192.168.3.11 if you prefer that.
In addition, disable the DHCP server. (as you have it in your screen shot). The WRT cannot be a DHCP server when used as access point.
Save settings and then wire one of the numbered LAN ports of the WRT to your existing LAN. Don't use the internet port! Now the WRT is a simple wireless access point and ethernet switch. It does not do any routing, DHCP, or similar.

Open Guest Network and DHCP utilisation

Similar Messages

Maybe you are looking for