topic Wireless Clients over WAN in Wireless

Wireless Clients over WAN

Philip T Kurien — Sun, 04 Jul 2021 07:02:17 GMT

Dears,

I have a specific requirement from a client as follows

The client has a branch office and HQ connected over an MPLS cloud. Internet access is provided through the HQ only.

They want to provide guest internet in the branch and want to terminate this subnet for the guest on the firewall in the HQ directly, so that they exit only into the internet.

Can anybody shed more light on how it can be done? or any other suggestions?

NB: They have only 1 controller, so putting a controller on the DMZ for guest is out of the question.

Regards,

Phil.

Re: Wireless Clients over WAN

Scott Fella — Tue, 07 May 2013 12:04:31 GMT

Well there is no other way unless you setup a VRF from the guest subnet at the remote site that terminates to the DMZ at HQ.

Sent from Cisco Technical Support iPhone App

Wireless Clients over WAN

Philip T Kurien — Tue, 07 May 2013 12:28:22 GMT

Thanks Scott,

How about a Gre tunnel between the sites? tunnel ingress will be the switch where the svi is created and the egress will be the device just before the firewall?

Wireless Clients over WAN

Scott Fella — Tue, 07 May 2013 13:11:14 GMT

You can do that too... there is just nothing you can do on the wireless side, it has to be done another way using VRF or GRE.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Wireless Clients over WAN

mscherting — Tue, 07 May 2013 22:24:18 GMT

A Guest (or DMZ) vrf would work.

On the WLC, build a dynamic interface in the Guest vrf. Map a guest wlan to this interface. In the branch, H-REAP APs can switch internal traffic to a local subnet and tunnel guest traffic back to the WLC's guest interface.

With WLCs at both HQ & branch, each site could have its own subnet & dynamic interface in the guest vrf if desired.

Wireless Clients over WAN

Abhishek Abhishek — Thu, 09 May 2013 21:59:06 GMT

Hello Philip,

As per your query i can suggest you the following solution-

As the client has a branch office and HQ connected over an MPLS cloud. Internet access is provided through the HQ only.We need to set up Virtual Route Forwarders (VRF) of GRE as they are connected through MPLS network.

You can set up dynamic interface on Guest VRF and map the guest wlan to this interface.

Hope this will help.

Wireless Clients over WAN

Philip T Kurien — Tue, 21 May 2013 20:04:54 GMT

Dears,

Luckily everything worked as to plan.

The client already had an existing controller in the HQ, So i created a WLAN anchoring to the HQ WLC. and then to the firewall direct.

Cisco doesnt recommend using the anchor controller to manage APs, however, there are APs in the HQ that are registered to this controller.

Thanks for all the inputs, will be really useful to try out if i didnt have a controller in HQ.

Regards,

Philip.