Controllerless Networks

Hi Guys,

I am setting up Guest Wifi using IAP 205. There are 5 APs connecting to a cisco ethernet switch. One of the IAP will become a VC.

There is going to only one Vlan, One SSID, One Profile Guest.

 

Questions:-  

1. How to config Guest Wifi for everyone with PSK authentication and Captive portal. 

2. DHCP will be configured on the switch. Do i need a create a different pool for APs and Users.

 

1) When you click new SSID, use the Guest option. Select captive portal/spash and PSK in the wizard.

2) Yes, your APs should be on a different subnet than your users

Thanks Tim.

 

Since these are private IPs, How do i perform Natting on it.

 

If you use the built-in guest network, it will NAT the addresses to the VC
address. If you use existing IP space, you'll need to NAT upstream.

So i need to Nat out to VC IP.  Does this VC IP have to be in the same subnet.

 

For example:- I have 192.168.1.0/26  (Vlan 10) for the users and 192.168.2.0/28  (Vlan 20) for the APs

 

Does this VC IP have to be in the same subnet which i used for APs.

 

Will DHCP assign an IP to the VC or Is it going to be manual?

 

 

 

Sorry for so many questions. 

If you select the guest under ssid you have the default ip addressing and vlan set to virtual controller assigned and vlan default. This will result in an ip subnet of 172.31.98.0/23 for your guests and the vc will do the source nat by default

Is there a way we can define our own subnet for Guest wifi?

 

is that possible?

And if you setup acl for the guest ssid you can limit the guest from accessing the internal ip subnet and only allowing access to Internet. Works like a charm

YES you can. Instead of selecting default as client ip subnet during guest ssid setup select custom and create a new scope.

Thanks Mr zero..
Can we choose VC IP be in the same subnet as IAP Subnet.
If I give my IAPs range of 192.168.1.0.
Do I have to use the VC IP from the same range. Or should it be different subnet?

I never tried it with the same subnet. But why bother and running into issues. Best practice is to use a different subnet for your clients and IAP's, so not in the same subnet.
This way you can also limit access to the IAP's through that wireless network,

Cheers