Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASA5505 configured with an inside and outside interface and DHCPD for the inside interface. Currently I have a cisco AP (forgot the model) broadcasting only a single essid for the internal network. I want to make it broadcast a second essid and put it on a different vlan so it won't have access to the internal network. The problem I forsee is getting dhcp address guest network. I need to make sure that the dns addresses that are assiged is a public dns and not the internal one (they wont be able to access it).

Here is my would be AP config:

dot11 ssid INTERNAL
   vlan1
   authentication open 
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 XXXX
!
dot11 ssid GUEST
   vlan 3
   authentication open
   mbssid guest-mode
!
interface Dot11Radio1
 no ip address
 ssid INTERNAL
 ssid GUEST
 mbssid
 station-role root

interface BVI1
ip address 10.0.0.250 255.255.255.0

For the ASA I would add the following:

int eth 0/7
switch port mode acc vlan 3

How do I get address to the guest essid?
Anything else I should configure?

For reference this is my ASA's DHCPD config:

dhcpd dns 10.0.0.101
dhcpd lease 7200
dhcpd domain blah.com
dhcpd address 10.0.0.110-10.0.0.170 inside
dhcpd enable inside
share|improve this question

1 Answer 1

up vote 0 down vote accepted

I was able to find my answer from http://www.dasblinkenlichten.com/?p=5

Configure a third VLAN (vlan 3) 
ASA(config)# int vlan 3  
ASA(config-if)# no forward interface Vlan1  
ASA(config-if)# nameif GUEST  
ASA(config-if)# security-level 50  
ASA(config-if)# ip address <ip address> <subnet mask>

Assign the VLAN to a switchport 
ASA(config)# int ethernet0/<Interface number> 
ASA(config-if)# switchport access vlan 3

Create a new DHCP scope for the guests and apply it to the VLAN 
ASA(config)# dhcpd address <start address>-<end address> GUEST 
ASA(config)# dhcpd dns <Outside DNS server> interface GUEST 
ASA(config)# dhcpd enable GUEST

Enable outbound access by adding to the NAT 
ASA(config)# nat (GUEST) 1 <Guest subnet number> <Guest subnet mask>

Configure the Managed switch you are using to connect the AP and the ASA 
Configure a port on the switch for the AP 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport mode trunk 
Switch(config-if)# switchport trunk allowed vlan <production vlan number>, 3

Configure a port on the switch for the Guest VLAN 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport access vlan 3

Configure a port on the switch for the Production VLAN 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport access vlan <production vlan number>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.