Hi,
At one of our locations, I have a campus of 2 buildings; one is set back quite a way from the street and the other is up against a street with residences facing it. I have fiber between the buildings. The residential facing building ("Down the Hill") has all its traffic routed at a L3 switch "up the hill" in the main building. Up the Hill, we have a cluster of 7 115 APs in an Instant cluster, broadcasting 4 SSIDs, each on a different VLAN / subnet, plus the management VLAN for the instant cluster.
Because of the physically removed location of the Up the Hill building, we have an open SSID connected to a U-Verse connection we use for corporate guests. (Yes, yes, I know, clear pass... we're getting there, but for now, it's an open.) This is carved off at L2 and users cannot access our corporate network. It's just an internet connection.
To improve wireless performance Down the Hill, they want me to install 115s down there as well. However, as soon as I plug them in, because they're Instants, they'll pull the config of the cluster and start broadcasting the same SSIDs, including the open, unsecured guest SSID. In doing so, we're suddenly providing free wireless for everyone within earshot, which is quite a few homes.
So the question becomes: Can I disable an SSID for a select number of raidos in an Instant cluster? Or, is the best design to carve off a VLAN/subnet for a new Instant cluster and configure it separately, leaving off the VLAN / SSID for that unsecured guest network? (Ok, not the BEST design, but a better one at least.)