We have 2 wireless networks set up using vlans on a system of HP Wireless Access points.

The first is intended for staff, and uses WPA2+radius to authenticate to our AD server, and puts the user on vlan 1

The second is intended for guests, uses simple WEP encryption, and puts the user on vlan 2

Currently both wireless networks give full access to our internal network.

What is the best/easiest way to restrict the guest wireless network to outgoing internet access only?

(and what additional information do you need to provide a good answer?)

Additional Information

  • Our network is co-located, with servers at our ISP, and internally to our office
  • Our outside firewall is located at our ISP location, as all internet traffic flows through there. Cisco routers at both locations
  • traffic between the two is sent over a Cisco
  • Our wireless APs are all connected to HP or Cisco (vlan capable) switches in our internal network
  • outgoing internet traffic flows through our border switches to the Cisco router in the office, to the Cisco router at our ISP, and then out to the world.
  • You'll need to provide some info about your network topology. Such as do these VLANs terminate onto a single switch? How do these VLANs transit to the internal network? Where are they in relation to your default gateway to the world? What is serving as your default gateway?
    – Dan Carley
    Jun 17 '09 at 13:55
  • Okay, I have added some additional information
    – Brent
    Jun 17 '09 at 15:09
  • Does it make sense that the Cisco routers could be configured to direct all traffic on vlan2 to the outgoing internet connection somehow?
    – Brent
    Jun 17 '09 at 15:13

Put a firewall between the AP and the internal network and only allow access to the internal network if traffic originates on vlan 1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.