0

I have an ASA5505 configured with an inside and outside interface and DHCPD for the inside interface. Currently I have a cisco AP (forgot the model) broadcasting only a single essid for the internal network. I want to make it broadcast a second essid and put it on a different vlan so it won't have access to the internal network. The problem I forsee is getting dhcp address guest network. I need to make sure that the dns addresses that are assiged is a public dns and not the internal one (they wont be able to access it).

Here is my would be AP config:

dot11 ssid INTERNAL
   vlan1
   authentication open 
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 XXXX
!
dot11 ssid GUEST
   vlan 3
   authentication open
   mbssid guest-mode
!
interface Dot11Radio1
 no ip address
 ssid INTERNAL
 ssid GUEST
 mbssid
 station-role root

interface BVI1
ip address 10.0.0.250 255.255.255.0

For the ASA I would add the following:

int eth 0/7
switch port mode acc vlan 3

How do I get address to the guest essid?
Anything else I should configure?

For reference this is my ASA's DHCPD config:

dhcpd dns 10.0.0.101
dhcpd lease 7200
dhcpd domain blah.com
dhcpd address 10.0.0.110-10.0.0.170 inside
dhcpd enable inside

1 Answer 1

0

I was able to find my answer from http://www.dasblinkenlichten.com/?p=5

Configure a third VLAN (vlan 3) 
ASA(config)# int vlan 3  
ASA(config-if)# no forward interface Vlan1  
ASA(config-if)# nameif GUEST  
ASA(config-if)# security-level 50  
ASA(config-if)# ip address <ip address> <subnet mask>

Assign the VLAN to a switchport 
ASA(config)# int ethernet0/<Interface number> 
ASA(config-if)# switchport access vlan 3

Create a new DHCP scope for the guests and apply it to the VLAN 
ASA(config)# dhcpd address <start address>-<end address> GUEST 
ASA(config)# dhcpd dns <Outside DNS server> interface GUEST 
ASA(config)# dhcpd enable GUEST

Enable outbound access by adding to the NAT 
ASA(config)# nat (GUEST) 1 <Guest subnet number> <Guest subnet mask>

Configure the Managed switch you are using to connect the AP and the ASA 
Configure a port on the switch for the AP 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport mode trunk 
Switch(config-if)# switchport trunk allowed vlan <production vlan number>, 3

Configure a port on the switch for the Guest VLAN 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport access vlan 3

Configure a port on the switch for the Production VLAN 
Switch(config)# int ethernet0/<Interface number> 
Switch(config-if)# switchport access vlan <production vlan number>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .