I'm currently sorting out our network so we can have new wireless access points with dual SSIDs, one for internal use and one for guest use. These will be setup so each SSID is on a different VLAN. I'm connecting them all to a PoE switch. Note, the APs are NOT Watchguard's own.
My question is how best to connect this to our Watchguard firewall. Currently the whole internal network is on a single /24 subnet and connects to one trusted port on the Watchguard. No VLANs involved. DHCP is provided to clients (wired and wireless) by a Windows Server on this network.
My possible solutions:
Connect the existing internal network switches to my new PoE switch (with the new wireless points) and then connect that switch to the Firebox. Change the existing Firebox trusted port to be a VLAN one with one VLAN for trusted and one for Guest WiFi. The Watchguard will do DHCP for the guest Wifi and trusted Wifi will continue to come from the existing DHCP server (and use the existing subnet).
Leave the existing trusted network pretty much as-is and connect the new PoE switch to a separate port on the Watchguard. Configure this as a VLAN port, again with two VLANs, but with the Watchguard doing DHCP for both, i.e. trusted wireless clients will now be on a new subnet. This would required some additional firewall config to route between the existing trusted network and the new trusted wireless subnet.
I was leaning towards (1) but am wondering if (2) is the better method as it seems to provide more separation for the Guest WiFi. Although in theory the VLAN should separate it anyway.
Any thoughts welcome.