Restricting access on wireless vlan

Question

We have 2 wireless networks set up using vlans on a system of HP Wireless Access points.

The first is intended for staff, and uses WPA2+radius to authenticate to our AD server, and puts the user on vlan 1

The second is intended for guests, uses simple WEP encryption, and puts the user on vlan 2

Currently both wireless networks give full access to our internal network.

What is the best/easiest way to restrict the guest wireless network to outgoing internet access only?

(and what additional information do you need to provide a good answer?)

Additional Information

Our network is co-located, with servers at our ISP, and internally to our office
Our outside firewall is located at our ISP location, as all internet traffic flows through there. Cisco routers at both locations
traffic between the two is sent over a Cisco
Our wireless APs are all connected to HP or Cisco (vlan capable) switches in our internal network
outgoing internet traffic flows through our border switches to the Cisco router in the office, to the Cisco router at our ISP, and then out to the world.

You'll need to provide some info about your network topology. Such as do these VLANs terminate onto a single switch? How do these VLANs transit to the internal network? Where are they in relation to your default gateway to the world? What is serving as your default gateway?
Does it make sense that the Cisco routers could be configured to direct all traffic on vlan2 to the outgoing internet connection somehow?

Mikael Auno · Answer 1 · 2009-06-17 13:55:00Z

up vote 1 down vote accepted

Put a firewall between the AP and the internal network and only allow access to the internal network if traffic originates on vlan 1.

answered Jun 17 '09 at 13:55

feedback

1 Answer