3

We are attempting to set up a guest WLAN network that is isolated from the rest of our network. This is proving difficult due to a couple of technical reasons. My first choice was to use a separate VLAN, on which our Firewall's handy WLAN port would handle DHCP, DNS and the network isolation we need. Unfortunately, due to the fact that our main office and our Internet connection itself are in different locations connected by way of a Metro Ethernet connection, I'm at the mercy of our ISP for VLAN transit.

They won't pass a second VLAN between our two sites. And my hardware doesn't support 802.1ad "Q-in-Q", which would also solve this problem. So I can't use the VLAN method for isolation. At least not without spending money.

As our Firewall can handle IPSec site-to-site VPN connections, I hope it is possible to connect a Server 2008R2 (standard) server I have in the office location to the WLAN and provide gateway services to the firewall. Thusly:

Network diagram

Unfortunately, I don't know if it is possible to connect the two this way. The firewall has a pretty flexible IPSec/L2TP implementation (I've used it to connect iPads in the wild), but is neither Kerberized or supports NTLM. The Connection Security Rules view on the Windows server seems to get close to what I think needs to be done, but I'm failing on figuring out how to get it to do what I need it to do.

Is this even possible, or do I need to pursue alternate solution?

2 Answers 2

0
  1. Well, I would give guests only access to one computer (their default gw) which is configured for proxying/NATting to the internet.
  2. One way to tunnel a vlan through another if you have a linux box somewhere: Ubuntu Community - VPN over SSH
1
  • That's just the thing, in this location I don't have a Linux box available. That solution is possible under 'pursue alternate solutions.'
    – sysadmin1138
    Jun 19, 2012 at 15:39
0

It turns out that Server 2008 R2 Standard does NOT have an ability to support a Site-to-Site VPN. Microsoft is shipping that functionality with their and Forefront products.

That qualifies as "other solutions" for this question, equivalent to Linux-based IPSec solutions.

Unfortunately, it looks like Standard does NOT do what I need it to do.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .