I am planning to implement guest WiFi access in my network.
Already we have the Cisco AP & WLC in place. The existing Cisco AP has 1 SSID for intra WiFi access.
The WLC is in the Data center & the APs are in branch locations.
I want to setup additional SSID for Guest Internet access.
For the internet Guest access it will have local breakout to Internet from the branch.
So would like to understand, how to achieve network segregation in this scenario.
The Guest VLAN should have access only to Internet.
No access to corporate network & the guest VLAN should be isolated.
My Plan:
- In Each floor there is guest VLAN which needs internet access.
- For Each Guest VLAN, I will apply ACL so that It does not communicate with other internal segments.
Questions:
- On Core Switch(L3#1,L3#2) is it required to add default route pointing to R#1 & R#2 ?
- Is it possible to achieve without Default route in R#1 & R#2 ?
The reason for asking this is because if default route is added in L3#1 & L3#2, even other segments will have route to internet which I want to avoid
- I want to have route only to the Guest VLAN(Segment)
How to achieve this ? Is some kind of policy map or policy route in L3#1 & L3#2, will help in achieving this ?
