Wireless Guest network config question

Hello,
I have installed SAP2602I access points at my customers location and configured a corporate network and a guest network. Everything works fine except when a user is connected to the guest network, they cannot access a web server that is hosted internally. Users on the guest network can access any other web-site fine, just not the one hosted by this same company on a local machine. This locally hosted web-site can be accessed by users from the Internet just fine.
I am guessing there is an issue with routing but I am not sure what, any ideas?
Thanks,
Mitchell Smith
North Texas Networks

Hi Steve,
Thanks for your reply. I am sure the problem is a hair pinning issue as the firewall config does not allow connections to the outside address from internal clients.
Can you give me a sample config to make this work? Is it just a firewall mod or more than that?
Thanks,
Mitchell

Similar Messages

Wireless Guest Network, iPADS and MAC Filteing

Hello, I have a question regarding our wireless guest network and using iPADs
Our wireless network consist of (3) 5508 WLC’s running 6.0.188. 2 internal WLC and 1 external anchor WLC for guest. Presently we are only using one of the internal controllers for users the second is only used for fail over. The anchor controller is set up as the DHCP server for guest. We also have a Cisco NAC Guest Server in the DMZ for guest authentication.
We have (10) iPads that need Internet access though our guest portal. We do not want these iPADs to have to enter any credentials just pass through to the internet. We do not want any other device to be able to connect to this SSID. Here’s my question; Getting to the Internet is no problem however when I try to set up a MAC filter just for these devices, they never receive an IP address and never get connected. I have tried setting the filter on both the internal controller and the anchor controller identically and in about every combination I can think of. Does anyone know how to set up a MAC filter on a guest network configured as per Cisco’s recommendation? I also plan to use WPA2 and 802.1x once I get the MAC filter to work. Any help would be appreciated.
Thank You
John

Not all layer 2 and layer 3 security mechanisms are compatible. Refer to this doc
http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080987b7c.shtml#matrix
What security settings have you configured. The settings also need to be identical on both the internal and anchor controller.

Wireless Guest Network using Cisco 4402 as an Anchor Controller

Hello,
We have recently redesigned our wireless guest network in accordance to Cisco's recommended deployment using the anchor controller in the DMZ. We have created two mobility groups (enterprise and anchor). The anchor controller and DMZ has two subnets (guest managment and guest clients). The guest management subnet is connected to the controller and firewall allowing the mobility groups and EOIP tunnels while the guest client network is also connected to the controller and firewall to push the client traffic directly out the firewall. The setup works well but the one part that I'm not happy with is the DHCP. Currently DHCP is being handled on the firewall because of issues we had with dhcp relay and the controllers internal dhcp service.
Does anyone have any information on getting DHCP relay working or the internal dhcp service on the controllers when using as a anchor?
This is basically the setup guide that we followed.
http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob41dg/ch10GuAc.html
Thanks!

Hi,
Make sure you have the IP helper address configured under the VLAN interface on the L3 and also make sure to disable DHCP proxy on both the WLC (Anchor and Foreign).
This will help us as well..
lemme know if this answered your question..
Regards
Surendra
====
Please dont forget to rate the posts which answered your question and mark it as answered or was helpfull

Wireless Guest Network Setup

Hi Guys,
We have a wireless network using Cisco infrastructure (WLC 4402, WCS, thin clinet APs).
We also have guest wireless network and we are using a third party aplication for web authentication.
I am trying to setup wireless guest network using WLC and WCS and wolud like to remove the third party application.
I really don't know where to start. I am expecting a complete step by step kind of a information or atleast some use full hints and links.
Thanks in advance.

Hi Sohail,
here is the step by step procedure to configure the Web auth using cisco WLC..
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008067489f.shtml
Lemme know if this answered ur question!!
Regards
Surendra

Wired + Private Wireless + Guest Networks

I'm attempting to setup a configuration that I don't seem able to get correct. I have a small wired network at my church with a file server and a couple of dozen users, some of which have laptops and would like to be able to roam wirelessly through the building. In addition, I would like to have an unsecured wireless guest network for visitors which provides access to the internet and does not have access to the file server.
The specifics are a wired 192.168.1.xxx network with a NAT'd DSL modem/router. I have 4 Airport Extreme dual radio N devices. I've tried setting the first Airport Extreme unit to shared IP, the only setting that allows me to also use a guest network, with a private SSID handing out 172.0.xxx.xxx addresses and a guest network handing out 10.0.xxx.xxx addresses. It seems logical to me that I would want to used bridged mode to allow my private wireless uses to see the server, but the Airport Extreme tells me I can not use a guest network with that setting.
With this setup, I can not get to my server by name, but I can get to by IP address. I guess that's not a huge problem since I have such a small number of users, I can add the server IP address to a hosts file on each client. What bothers me most is that I can get to the server IP from the guest network as well as the private network. Am I missing something?
My second point of confusion is when I try to configure the other 3 Airport Extremes to extend the network. The configuration tools asks me which wireless network I want to extend, and allows me to choose only the private network OR the guest network. I thought it should be able to extend both networks simultaneously. Am I mistaken on this as well?
I'm certain I've left out plenty of information you may need to assist so please ask, I will gather what ever I can. Thanks in advance.

Hello muellgre. Welcome to the Apple Discussions!
Unfortunately, Apple does not provide you with very many options when it comes to their Guest network feature. It is basically designed to work with a single AirPort/Time Capsule router in your network configuration.
As you have found out, it will only be available if you have the AirPort configured as a NAT router and not as a bridge. Also you cannot extend a Guest network. I'm actually surprised that you were given this option.
Since you have a DSL gateway upstream of your AirPorts that is performing as your primary Internet router, you would want all of your AirPorts to be configured as bridges. Regardless if you were connecting them all back to the DSL gateway by Ethernet or creating a WDS extended network.
If you go the route of configuring a single Extreme as a router, you will have a Double NAT configuration, which is not bad in itself, but does add some complexity when attempting to share between network segments.
One option would be to reconfigure the DSL gateway as a bridge, and then, configure one of the Extremes as a router to allow it to handle NAT & DHCP services for the network. This will also give you your guest network. You can also extend this Extreme with the others, but not its guest network ... so, overall, this might not satisfy all of your networking requirements.

Trying to set up a wireless guest network using Airport base station. The first network setup was fine but the second one doesn't work. Any suggestions?

I purchased the new Airport base station that allows for a wireless setup of a primary network and a guest network. The primary network installation worked great but I cannot get the guest network to work properly. Any suggestions on how to make it work?

The AirPort base station is designed to connect to a simple modem......not a modem/router or gateway device that is often furnished to users by Internet Service Providers.
So, the first troubleshooting question would be to find out what the make and model of the device that you call your "modem" might be.....to see if you have the right kind of product that will allow the Guest Network to operate correctly.

1801W wireless (guest access) config issues

Trying to setup wireless on 1801w ISR. Wired access to Internet and LAN works fine (Vlan1); however, wireless (Vlan2) does not.
Trying to setup wireless "guest" access with Internet access only (no access to LAN).
Wireless will not come up. Dot11Radios show "reset/down".
Below is the wireless config and a couple of troubleshooting commands as well:
dot11 ssid open
   vlan 2
   authentication open
====================================================
!(Sets up DHCP and excluded addresses.)
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.25.1 172.16.25.99
ip dhcp excluded-address 172.16.25.116 172.16.25.255
ip dhcp pool open
   import all
   network 172.16.25.0 255.255.255.0
   default-router 172.16.25.1
   dns-server 4.2.2.1 4.2.2.1
   lease 3
====================================================
(Turned on integrated routing and bridging.)
bridge irb
====================================================
(Wireless radio interface config.)
interface Dot11Radio0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
ip route-cache flow
encryption vlan 2 mode wep optional
!---(SSID is given as "open")
ssid open
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
station-role root
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Vlan1
description LAN
ip address 192.168.0.100 255.255.255.0
ip nat inside
ip virtual-reassembly
interface Vlan2
description Wireless VLAN
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address 172.16.25.1 255.255.255.0
ip nat inside
ip virtual-reassembly
bridge 1 protocol ieee
bridge 1 route ip
====================================================
Verifying...
RTR#sho dot11 associations
802.11 Client Stations on Dot11Radio1:
802.11 Client Stations on Dot11Radio0:
SSID [open] : DISABLED, not associated with a configured VLAN
====================================================
RTR#sho ip int brief
Dot11Radio0                unassigned      YES NVRAM reset                 down
Dot11Radio0.1             unassigned      YES unset reset                 down
Dot11Radio1                unassigned      YES NVRAM reset                 down

Your ssid is configured in vlan 2.
But you forgot to configure dot11radio0.2 with under it "encapsulation dot1q 2".
That should allow the radio to broadcast ssid
Nicolas
===
Don't forget to rate answers that you find useful

Creating a wireless guest network.

Good afternoon,
I'm trying to set up a guest network for my lad to use with his Xbox 360, laptop, iphone, etc.
At present I have my iMac, Airport Extreme Base Station, Airport Express all connected to my Sky broadband router. I also watch films on my 360 and AppleTV2 via iTunes.
Is there a way to create a network (to access the internet only) so my lad can't watch the films I have on iTunes? He'll also feel good as he'll have his own network (not realising I'm limiting his access;))
Thanks very much for any help in advance,
McFly.

Unfortunately, the Guest Network option is generally not available when the AirPort Extreme is used with another modem/router....in this case the Sky product.
You can check to see if your setup will allow this as follows:
Open Macintosh HD > Applications > Utilities > AirPort Utility
Click on the AirPort Extreme icon, then click Edit
Click on the Wireless tab at the top of the window
Check to see if there is an option to Enable the Guest Network
If yes, assign a name to the network, security and and a password and click Update to save the new settings.
However......If the option to Enable the Guest Network does not appear (see example below), unfortunately you will not be able to setup another wireless network.

HT4259 Can a wireless guest network be extended?

Our church has two Airport Extreme Model A1354. Our main wireless network, called FCCAK, is extended just fine throughout the building. Our Guest network, called FCCAK Guest, is not reaching the basement, and it looks like that network is not being transmitted at all from the extender Router. The Airport Extreme Utility has no check box on the guest network Tab to "extend this network." Can we extend two wireless networks using our two Airport Extreme routers? We bought both of these at the same time in March 2010.

Unfortunately it is not possible to extend the guest network from an Airport, it is only possible to extend the "main" network.

Unsecured wireless guest network.

I have Linksys E3000 router.
I have 2 wireless networks set up: One named BigMoose which shows to be secured. The guest wireless neetwork is
BigMoose-guest. It shows that it is unseured.
My problem is: I don't know how to make it secured. I have a seperate password for the uest site but when someone signs
into it they are not asked for the password.
Can someone please help me with this?
I am using Widows 7 Ultimate on my desktop and Windows 8.1 on my laptop. Also 8.1 on my Windows Surface Pro.
Tom

geekychix wrote:
sabretooth wrote:
Guest networks are UNSECURED on all Linksys routers. However you will need a password to access the internet. Why Linksys chose this method, I have no idea. That's one reason these routers should not be placed in a public area, home use only.
All other manufacturers have full WPA2-AES security on their guest networks.
Hi sabretooth,
Guest network is secured. It appears to be unsecured but once you will access a website it will prompt you for the password, @cuberoot is correct there is no option to unsecure the guest network if there is teach me how.
Guest networks are designed for guest, so that if you have visitors they couldn’t access your files because it has a different IP address. The IP address of the guest network is 192.168.3.XX
It is... OK please tell me what security is available for the Guest network please? WPA, WEP or WPA2??

RV220W Wireless Guest Network

I have two RV220W (one is the main router and the other is acting like an access point). The main one [192.168.1.1] is located in our server room so wireless signal from there is very limited. The access point [192.168.1.2] is in the main reception area so has the best signal to give (nothing is plugged into the WAN port).
I want to create a Guest network on a different subnet on the access point RV220W. I've created a separate wireless connection and assigned a different VLAN/Subnet [192.168.2.0] for the guest network. I just want this network to have internet access only, as it is for the customers in the waiting room.
I have it all going, but have no internet connection for that wireless network. I don't know networking very well, but I do have a good understanding of it.
How would I accomplish this?
Thanks for any help.

azhskr1507,
Since the unit has been with you within a month or so i would recommend opening a support ticket. Once you do engineer would assist you in the troubleshooting. You have mention you did a reboot on the unit, did you happen to do a factory reset for 30 seconds ? The client users that are not connecting, what devices are they using?

ISE and NAC wireless guest networks

I have a wireless network that is NAC controlled and use lobby ambassador for guest wireless. What is the best way to migrate to ISE for guest. Are there problems running NAC and ISE on the same controller?
Sent from Cisco Technical Support iPad App

Hello,
For your query regarding ISE and NAC following are my findings, which might help you in order to solve your query.
for your first question:-
ISE is a free software upgrade for customers who have NAC appliance or NAC profiler. This is for both for the base and advance licenses.
ISE is a 50% software discount for customers who have NAC guest server. The 50% discount is a migration part for the base license only. The advance features license will not be impacted by this discount.
for your second question:-
There should be no issues running NAC and ISE on the same controller until and unless you are using two SSIDs.

Wireless authentication network design questions... best practices... etc...

Working on a wireless deployment for a client... wanted to get updated on what the latest best practices are for enterprise wireless.
Right now, I've got the corporate SSID integeatred with AD authentication on the back end via RADIUS.
Would like to implement certificates in addition to the user based authentcation so we have some level of dual factor authentcation.
If a machine is lost, I don't want a certificate to allow an unauthorized user access to a wireless network. I also don't want poorly managed AD credentials (written on a sticky note, for example) opening up the network to an unathorized user either... is it possible to do an AND condition, so that both are required to get access to a wireless network?

There really isn't a true two factor authentication you can just do with radius unless its ISE and your doing EAP Chaining. One way that is a workaround and works with ACS or ISE is to use "Was machine authenticated". This again only works for Domain Computers. How Microsoft works:) is you have a setting for user or computer... this does not mean user AND computer. So when a windows machine boots up, it will sen its system name first and then the user credentials. System name or machine authentication only happens once and that is during the boot up. User happens every time there is a full authentication that has to happen.
Check out these threads and it explains it pretty well.
https://supportforums.cisco.com/message/3525085#3525085
https://supportforums.cisco.com/thread/2166573
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Network config question: Transfer IP/s from one server to another

Both server running Solaris 8:
SERVERA: $ ifconfig -a
lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
hme0: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.132 netmask ffffff00 broadcast 10.36.19.255
hme0:1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.136 netmask ffffff00 broadcast 10.36.19.255
hme0:2: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.168 netmask ffffff00 broadcast 10.36.19.255
hme0:3: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.148 netmask ffffff00 broadcast 10.36.19.255
hme0:4: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.145 netmask ffffff00 broadcast 10.36.19.255
hme0:5: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.147 netmask ffffff00 broadcast 10.36.19.255
qfe1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.132 netmask ffffffc0 broadcast 140.20.140.191
qfe1:1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.148 netmask ffffffc0 broadcast 140.20.140.191
qfe1:2: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.136 netmask ffffffc0 broadcast 140.20.140.191
qfe1:3: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.168 netmask ffffffc0 broadcast 140.20.140.191
qfe1:4: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.144 netmask ffffffc0 broadcast 140.20.140.191
qfe1:5: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.142 netmask ffffffc0 broadcast 140.20.140.191
qfe1:6: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.146 netmask ffffffc0 broadcast 140.20.140.191
qfe1:7: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.143 netmask ffffffc0 broadcast 140.20.140.191
qfe1:8: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.147 netmask ffffffc0 broadcast 140.20.140.191
qfe1:9: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.155 netmask ffffffc0 broadcast 140.20.140.191
qfe1:10: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.157 netmask ffffffc0 broadcast 140.20.140.191
qfe1:11: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.145 netmask ffffffc0 broadcast 140.20.140.191
SERVERB$ ifconfig -a
lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
hme0: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.36.19.164 netmask ffffff00 broadcast 10.36.19.255
qfe1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 140.20.140.164 netmask ffffffc0 broadcast 140.20.140.191
qfe2: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4> mtu 1500 index 4
inet 11.11.11.2 netmask ffffff00 broadcast 11.11.11.255
qfe3: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 5
inet 10.36.29.164 netmask ffffff00 broadcast 10.3.29.255
qfe6: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 6
inet 11.11.10.2 netmask ffffff00 broadcast 11.11.10.255
What is involved to transfer the IPs 10.36.19.145 (hme0:3:) and 140.20.140.142 (qfe1:#:) to serverB?
Would that cause a lost of network connection to either 10.36.19.132 or 140.20.140.132 on SERVERA
Would that require a reboot?
Thank you.

[[[What is involved to transfer the IPs 10.36.19.145 (hme0:3:) and 140.20.140.142 (qfe1:#:) to serverB?]]]
NIC configs are created using a combination of /etc/hosts | /etc/inet/ipnodes and /etc/hostname.<nic instance> files when system is booting up.
In order to permanantly remove an IP from a host's interface (say hme0:3)
you would have to do the following:
NOTE: Don't run this on Solaris 7 or below -- unplumbing a virtual interface in Solaris 7 or below will unplumb the actual physical instance as well!!
ifconfig hme0:3 down
ifconfig hme0:3 unplumb
Remove entry corresponding to the IP that was set up on hme0:3 from /etc/hosts and/or /etc/inet/ipnodes
remove /etc/hostname.hme0:3In order to reverse the process (or set up the IP on another host), just reverse the steps. Make entries in /etc/hosts and/or /etc/inet/ipnodes, /etc/hostname.<nic instance> (insert hostname corresponding to IP from /etc/hosts in this file).
ifconfig hme0:3 plumb
ifconfig hme0:3 <ip> netmask + broadcast + up[[[Would that cause a lost of network connection to either 10.36.19.132 or 140.20.140.132 on SERVERA
Would that require a reboot? ]]]
Make sure to turn off any service that might be tied into that IP address on server A. Otherwise you'll have a loss of service. For eg: if you have an apache instance that's bound to that IP address, make sure you make adjustments/corrections or turn it off before you unplumb your interface).
You don't have to necessarily reboot to make this happen. Just make sure you don't leave any stone unturned...

Guest Networking solution to workaround an older non-dual band AExtreme?

When I first set up my brand new (month old) Time Capsule (TC) to Extend a Wireless Network on my pre-existing Airpot Extreme (AE-2007 version) Ethernet connected network (simple modem), the Guest Network tab showed up during my AirPort Utilities (AU) adjustments. Yet, shortly after giving a name and password to the Guest Network the following dialogue appeared:
"DHCP Beginning Address:
The DHCP range you have entered conflicts with the WAN IP address of your AirPort wireless device" (showing: "10.0.1.2") and
"DHCP Ending Address:
The DHCP range you have entered conflicts with the WAN IP address of your AirPort wireless device"
(showing: "10.0.1.200").
There was no actual apparent conflict of addresses while otherwise my wireless network was working fine until then. Since I could not figure out how to solve this issue, I chose to revert (button) the action.
Now, although my wireless network is working fine, the Guest Networking tab is gone for good from my AU as well as my settings for Guest Networking is non-existent.
After searching for solutions herein the community forum, I figured that my AE in NOT a Dual Band version capable of the Guest Network option which AU had first presented me with.
MY QUESTION NOW IS:
If I switch to a new wireless set up having my brand new TC acting as the main base connected to the simple modem (Ethernet), leaving it to "Share a Public IP Address", while using my older AE to "Extend a Wireless Network", will I be able to get the Guest Network tab back in AU (to set up via TC) a wireless Guest Network?
Thanks in advance for your help!

MY QUESTION NOW IS:
If I switch to a new wireless set up having my brand new TC acting as the main base connected to the simple modem (Ethernet), leaving it to "Share a Public IP Address", while using my older AE to "Extend a Wireless Network", will I be able to get the Guest Network tab back in AU (to set up via TC) a wireless Guest Network?
Yes. Your TC is a dual-band model, so you'll have the option of creating a guest network as long as your TC is set to "Share a Public IP" and "Create a wireless network."
EDIT: Note that you won't be able to wirelessly extend the guest network. You'll still be able to wirelessly extend the main network.

Wireless Guest network config question

Similar Messages

Maybe you are looking for