VLAN Help

I'm trying to setup a wireless network here at work (a high school). I've installed 18 Proxim AP-4000 PoE access points connected to a Netgear FSM7326P PoE 24+2Port Layer3 switch. Here is a quick and dirty basic diagram:



As you can see the Netgear connects to the rest of my network that consists of basic unmanaged switches, that connect to a Watchguard Firewall to the internet. I have an "optional" port on the Watchguard that may help me do what I want.

So anyway, here is what I want to do. The Proxim APs support multiple SSIDs and VLAN tagging. Right now I've configured two SSIDs on the access points, Employee and Guest. The employee SSID is tagged VLAN ID 3 and the guest SSID is tagged VLAN ID 4. My goal is that the employee SSID will have full access to our internal subnet (10.10.x.x) and the guest SSID will have only internet access. I'm pretty sure I have my APs configured right, but now I need to configure the Netgear to recognize the VLANs. This is where I get lost. Can anyone provide any insight for me?

Bump

What model watchguard is it? Does it support VLANs? If you use the "optional" interface, does it just bridge the interfaces?

*for now, on the netgear, each port that goes to an AP should be configured as a VLAN trunk for VLANs 3 and 4.

The Watchguard is an X1000 running WFS 7.4 (the older OS). I don't think it supports any VLAN features.

Your best bet will be to do the following since some of your devices do not have VLAN support.

Use your new switch as the core router/switch for the network. Connect two internal ports from the firewall to that switch. Configure each port on your firewall for the corresponding internal network (employee and guest). Configure each port on the switch that is connected to the firewall as an access port and put them on the proper VLAN (3 or 4).

You will need to do this for your other unmanaged switches since they do not have VLAN or trunk support, but only for the Layer 2 piece.

This assumes that your wireless IP space is the same as your wired IP space for employees.

You also need some rules on the firewall to prevent packets from routing across one interface to the other.