Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have 2 wireless networks set up using vlans on a system of HP Wireless Access points.

The first is intended for staff, and uses WPA2+radius to authenticate to our AD server, and puts the user on vlan 1

The second is intended for guests, uses simple WEP encryption, and puts the user on vlan 2

Currently both wireless networks give full access to our internal network.

What is the best/easiest way to restrict the guest wireless network to outgoing internet access only?

(and what additional information do you need to provide a good answer?)


Additional Information

  • Our network is co-located, with servers at our ISP, and internally to our office
  • Our outside firewall is located at our ISP location, as all internet traffic flows through there. Cisco routers at both locations
  • traffic between the two is sent over a Cisco
  • Our wireless APs are all connected to HP or Cisco (vlan capable) switches in our internal network
  • outgoing internet traffic flows through our border switches to the Cisco router in the office, to the Cisco router at our ISP, and then out to the world.
share|improve this question
    
You'll need to provide some info about your network topology. Such as do these VLANs terminate onto a single switch? How do these VLANs transit to the internal network? Where are they in relation to your default gateway to the world? What is serving as your default gateway? –  Dan Carley Jun 17 '09 at 13:55
    
Okay, I have added some additional information –  Brent Jun 17 '09 at 15:09
    
Does it make sense that the Cisco routers could be configured to direct all traffic on vlan2 to the outgoing internet connection somehow? –  Brent Jun 17 '09 at 15:13
add comment

1 Answer 1

up vote 1 down vote accepted

Put a firewall between the AP and the internal network and only allow access to the internal network if traffic originates on vlan 1.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.