Setup Separate VLAN for Public Wifi

[mark-wa]

I am trying to setup a seperate vlan to go to a seperate WAP in my network, so I can provide guest internet access without my production network being visible. I’ve set it up, but it is not working. I created a sub-interface for the new vlan (VLAN 12) on my ASA5510 firewall. The new VLAN is 172.27.27.0/28, for example. I gave it an ip on that sub-interface of 172.27.27.1. Then, I connected the WAP and configured it to be on that VLAN and subnet. I found out the WAP isn’t DHCP (server) capable, so I set the ASA to act as the DHCP server for that VLAN. I connected a laptop wirelessly and it received an ip address from my normal inside DHCP server…??? How did it do that??? Also, I could get out to the internet and see the rest of my network. So, then I set the port on the switch that the WAP is connected to, to be on that VLAN only and now, my laptop won’t get an ip at all. So, just to see if the rest of the configuration is good, I statically assigned an ip address for that subnet on my laptop and I could see the WAP, but not the firewall. I tried pinging the sub-interface on the firewall and couldn’t. Also, I can ping the WAP, but I can’t actually access it via the web interface. But, if I leave that 172.27.27.x static address on the laptop and connect to my production wireless, I can get to the web interface of the WAP, but no where else. I’m not sure where I went wrong here. Any thoughts?

Thanks!!!

Mark

[mark-wa]

   Getting views... but no replies...

[Michael McNamara]

Hi Mark,

That's quite a few questions there...

Any chance you can post the relevant configurations for the Ethernet switch port and the access point?

Here's a full example from a Cisco 3750, each VLAN would be another ESSID on the AP;

interface GigabitEthernet0/1
 switchport access vlan 150
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 150
 switchport trunk allowed vlan 32,150,152,158,160,162,164,180
 switchport mode trunk

On a Cisco Access Point 1200 you would need something like so (VLAN 150 - 10.1.150.0/23);

interface BVI1
 ip address 10.1.150.75 255.255.254.0
 no ip route-cache

That would take care of your management interface, you would then need to configure the sub-interfaces on the AP including the  Dot11Radio interfaces and the bridge groups.

Cheers!

[mark-wa]

   The problem was a couple of different things:

1.  I didn't have the port between the firewall and the switch trunked, which I thought I had already done.
2.  I didn't have any acl's or nat'ing associated to that new subnet on the firewall.

It's working now!  Thanks for your input!

Mark