I'm currently sorting out our network so we can have new wireless access points with dual SSIDs, one for internal use and one for guest use. These will be setup so each SSID is on a different VLAN. I'm connecting them all to a PoE switch. Note, the APs are NOT Watchguard's own.

My question is how best to connect this to our Watchguard firewall. Currently the whole internal network is on a single /24 subnet and connects to one trusted port on the Watchguard. No VLANs involved. DHCP is provided to clients (wired and wireless) by a Windows Server on this network.

My possible solutions:

  1. Connect the existing internal network switches to my new PoE switch (with the new wireless points) and then connect that switch to the Firebox. Change the existing Firebox trusted port to be a VLAN one with one VLAN for trusted and one for Guest WiFi. The Watchguard will do DHCP for the guest Wifi and trusted Wifi will continue to come from the existing DHCP server (and use the existing subnet).

  2. Leave the existing trusted network pretty much as-is and connect the new PoE switch to a separate port on the Watchguard. Configure this as a VLAN port, again with two VLANs, but with the Watchguard doing DHCP for both, i.e. trusted wireless clients will now be on a new subnet. This would required some additional firewall config to route between the existing trusted network and the new trusted wireless subnet.

I was leaning towards (1) but am wondering if (2) is the better method as it seems to provide more separation for the Guest WiFi. Although in theory the VLAN should separate it anyway.

Any thoughts welcome.


You want option 1.

Set up your VLANs in watchguard's configuration, and setup an interface to be on both VLANs. On the new POE switch, configure one port to be an access port on your staff VLAN, and plug existing switch into it. Configure the rest of the ports to be trunks with both VLANs - these go to the firebox and to the APs.

When configuring the VLANs you can also specify DHCP server settings. Leave it turned off for your trusted VLAN, and turn it on for the guest one. That way your server continues doing DHCP for trusted computers, and the firewall will do it for guests.

When configuring the APs make sure their management interface is on the trusted network. Same for the switches. Neither needs to have any IP address on the guest VLAN.

VLANs are plenty sufficient to separate the traffic safely.

Be sure that the new POE switch can handle all the traffic from the rest of the network. If it is lower end model, and your existing switches are faster managed switches, you are probably better off configuring them for VLANs as well, and chaining the new POE switch off of them.

Option 2 would make life harder - since trusted wifi connections end up on a different subnet. How much of a pain that is depends on what people do, but overall I'd prefer to keep everyone on the same subnet. You don't really gain any security by doing it that way.

  • Thank you @Grant, good to hear I was thinking on the right lines. All the switches are going to be new "smart" ones and are from the same range so hopefully should be ok, in fact I was going to have the PoE one has the central one and plug the other ones directly into it, plus various servers etc. – george Mar 31 '16 at 21:51
  • @george added a bit about switch and ap ip addresses. – Grant Mar 31 '16 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.