How Would You Set This Up - Public Wireless

R

rosco

Gawd
Joined
Jun 22, 2000
Messages
722
I'm looking for your input on how you would setup the following:

- Small business with 30 desktops
- Has 20 wireless devices
- Needs secured wireless in and around the building for those 20 devices
- Needs open wireless for 40 - 50 guests in the building
- Has two HP Procurve switches already in place

I'm looking for what approach you would take and what hardware you would use.

Right now, the open wireless for the visitors allows them onto the internal network so I know I want to segregate that from the rest of the network.

I was looking at a Fortinet 80c and using a separate switch hooked to the DMZ port on the fortinet for the open wireless clients. I would have the access points for the open network hooked into that switch.

So, let me know how you would set it up and what equipment you would use.
 
Might depend on your router. We have the following:

Guest VLAN
Internal VLAN

WAPs capable of VLAN tagging, set traffic for a Guest SSID to go to Guest VLAN, and grab an IP from the scope of the DHCP server setup for a subnet for Guest devices.

Setup an ACL so that subnet can only access the internal network for DHCP traffic, block all else.

Another setup I did at a smaller business, use two wireless routers plugged into the comcast modem/switch. All internal stuff runs off one side, the rest runs off the separate router. It's not the best setup but it inherently blocks some traffic since they are on separate networks. Then I just locked it down further using time restrictions.
 
Along with isolating the pulblic wifi on it's own VLAN, I would look into running a captive portal. You don't want random users abusing your wifi from the parking lot. At least with the captive portal, it will require users to come in and get the password to get internet access.

May also help to setup a radius server to authenticate the private wifi for extra protection.
 
It's true you may want something like the CWP. In our case, we have content filtering in place that is most restrictive on the public network. I chose to disable the portal since it was such an administrative overhead that it wasn't worth it for us.
 
This:
  • Fortinet 80c
  • Ubiquiti Unifi 3 ok (for in the building)
  • Ubiquiti Rocket M outside (as required)
  • Guest VLAN
  • Internal VLAN
  • Setup an ACL so that subnet can only access the internal network for DHCP traffic, block all else.
 
Sonicwall
Create Public Wlan Zone
Vlan Private
Vlan Public Enable Guest Services.

Vlan the Switch.

Done.
 
Mackintire said:
This:
  • Fortinet 80c
  • Ubiquiti Unifi 3 ok (for in the building)
  • Ubiquiti Rocket M outside (as required)
  • Guest VLAN
  • Internal VLAN
  • Setup an ACL so that subnet can only access the internal network for DHCP traffic, block all else.
Click to expand...

I'm thinking this is the route I am going to go. Anyone patient enough to hold my hand and help with the VLAN part of this? I'm dumb when it comes to VLANS (and plenty other things but we'll focus on the VLANs for now.) The ACL would also be something I could use some help with.

I'm thinking I will go for the 80c bundle and get the content filtering, etc with it. Can I have two separate filtering policies in the Fortinet for the two different VLANs?
 
I can help you with that stuff. We have all Procurve equipment and I just went through setting this up. PM me whenever.
 
- What type of HP switches do you have?
- What router is in place now? Will this be something to be changed?

Depending on the size of the building, you can use a few 1141 Cisco WAPs. Trunk the interfaces they hook up to on the switch.

From there, it depends on the switches. If they are 2910 and have static routing, you can just add some access lists in there to allow the guest vlan to only route out to the internet and not touch anything else.

Other option is to physically map a VLAN to an interface which goes to your router as some type of DMZ, map the guest wireless to that vlan - then all the traffic goes straight out to the router to the internet.

If it is something like an ASA, you can also just create another vlan for just that, route the traffic straight out.
 
One switch is a HP 2510-48 and the other is a 2510G-24

I don't believe they do routing.

I'm currently using a monowall and I am planning on replacing it. Most likely with a Fortinet 80c bundle. Do I need something to do the routing?
 
That Fortinet 80c should be able to do any layer 3 routing that you may need. I'd use VLANs and place as much of the load on the switch as possible.
 
Totally agree with Mackintire on the config. All of that equipment will be easy to configure, including setting up the VLANs on the Procurve Switches.

You can set up a vlan subinterface on the Fortigate to handle your guest traffic, and even set up hours of operation on the policies for that subinterface to make it only usable during business hours. Keeps people from hanging in the parking lot at night leeching off your wifi. It'll have its own subnet and UTM profile - completely (electronically) isolated from everything else.

The APs can be set up with separate SSIDs with access to their respective vlans so each AP can carry traffic for either network.

If you were to use Fortinet's access points, it all becomes even simpler, but their APs are considerably more expensive than the Ubiquiti ones - and they really aren't any better IMO.

Word of advice - don't expect Fortinet to be much help. Their equipment works well, but their support is pretty worthless.

If you need guidance on any of it PM me.
 
You must log in or register to reply here.
Back
Top