Isolating Guest Wifi Traffic

[MischiefMonster]

Hello all - just looking to think through a situation here. Or, I guess, think through it then apply it to my Cisco small business switches.

So, as it stands now guest wifi is having an overhaul. It's not "live" yet but in testing I can ping/access web guis of my servers etc in other VLANs if I've joined the guest wifi - far from ideal! DHCP for that same guest wifi is on my main domain DHCP server. Load of WAPs around the place, just VLAN bridges really.

What I'd like to do is move DHCP for the guest wifi to my firewall, away from the DHCP servers. Also I'd like to make it so that guest wifi clients only can't ping each other, but definitely so they can't get to any resources on my network outside of the guest wifi VLAN, except for internet of course.

I'd be thinking then that I'd need to:

1 - Set the ip helper on the guest wifi VLAN to be the firewall and not the DHCP server (after I turn DHCP on on the firewall of course.)

2 - Set something up that stops the wifi VLAN allowing traffic to other VLANs.

Trouble is, I can't find those options in the GUI for the small business switches for (1). I'd guess the command line though would be:

int vlan [wifivlan]

no ip helper-address [old dhcp ip]

ip helper-address [new firewall ip goes here]

That sound about right? Any chance that'll upset the small business switches even?

Point (2) I must admit I don't really know how to achieve.

Can anyone passing tell me if my thinking is sound and/or if any better ways to achieve what I want to do? If so, commands or menu navigation would be mega helpful as I've been stumbling around a bit.

Thanks much all.

[paul driver]

Hello
What you ask is most certainly possible, you have multiple options but obviously these options are hardware/platform feature set dependant 
Some of these would be:

• DMZs (UTMs,FWs))
• ZBFW (software)
• VRFs
• router access-control lists (RACLS)
• private-vlans

TBH im not so sure SB switches would be able to accommodate with any of the above, but on a plus note, the fw you mention may be able to provide the isolation your looking for.

Can you elaborate a little on the hardware you have running?

[MischiefMonster]

Hi Paul - that was swift thanks for that!

Yep firewall is a Smoothwall (pretty vanilla setup.) Core is Cisco SX550X.

Next hop currently set to the Smoothwall in the switch.

You thinking something in turning inter-vlan routing off on that VLAN and letting the firewall do the DHCP and just pass the traffic by virtue of being next hop or something else?

Appreciate the reply also, thanks.

[paul driver · Accepted solution]

Hello

---

@MischiefMonster wrote:

You thinking something in turning inter-vlan routing off on that VLAN 

---

Exactly! - relocate the L3 wifi subnet onto the FW in its own DMZ  that should provide the isolation you desire.

[MischiefMonster]

Cheers! So, switch-to-switch VLAN for the guest wifi, WAPs still bridge to it as normal. No L3 anything. Smoothwall box just effectively sits in that VLAN, no nothing as far as config goes core switch-side, sort the lot in the Smoothwall. Sorry I am a simple man lol!

Grateful for the hand-holding there thanks Paul.

[paul driver]

Hello @MischiefMonster 
Correct the L3 core isnt even aware of the wifi subnet so the other vlans are isolated from it -the  KISS philosophy does work......sometimes -lol...

[Joseph W. Doherty]

@MischiefMonster and @paul driver are on the right track.  I just wanted to mention the key, to much security, is L2 domains usually require a L3 junction to allow them to intercommunicate.

At such a L3 junction you can often filter what's allowed to pass between L2 domains.

Firewalls generally offer fantastic security filtering and also usually, but not always, offer L3 capability too. Even when they do offer L3, they might be a performance bottleneck.  In your, so far, described goals, doubt that will be an issue.  However, something to be aware that might arise in the future if your network grows and/or evolves.

BTW, you may want some security filtering even between the Internet and your guest WiFi, and consider access control even to the guest WiFi.

[MischiefMonster]

Sounds like wisdom there thanks Joseph. I'll have a dozen people max on the guest wifi at any given time I'd think, so performance I think will be ok.

Cheers again both.

[MischiefMonster]

Ok had a few days spare so got to tackling this! Sure is fighting me...

So, to recap (mostly for my benefit here) we had a VLAN (35) which I want to make into a closed/switch-to-switch VLAN with its own dedicated interface on our firewall here. Firewall is to act as DHCP server for this VLAN only and allow the traffic direct out to the world whilst stopping it getting back onto our LAN or pinging it to keep it isolated as it's for guest wifi. As it was until this morning our LAN DHCP server did DHCP duty for it.

Went into the core then and put a single access interface on VLAN 35, plugged the cable in to the firewall.

On the Cisco core, in IP configuration > IPv4 Mgmt and Interface > IPv4 interface and deleted the SVI/interface listing for VLAN 35. I shouldn't imagine it'd need this for the VLAN to operate in the way I'm thinking, so this went.

Next, disabled the scope on the DHCP server.

Next, back on the core, went to IP configuration > IPv4 Mgmt and Interface > DHCP Snooping/Relay > Interface settings and deleted the entry for VLAN 35, my thinking being I don't want it sending DHCP requests to any of the listed DHCP servers.

The goal I had in mind was for it to operate like an old school network did, pre-VLANs. As in clients join the wifi at the WAPs with password, send a DHCP discover, firewall answers and gives an IP and then all works and the switching is effectively "dumb" to the lot!

I cannot get this working though, and cryptically clients joining this way are getting IPs in a totally different subnet on the DHCP server (!!!)

I have no idea what's doing this at this point lol! So thought I'd appeal to anyone passing for any ideas or thoughts. Or comforting words would do too!

Happy new year to anybody reading there and very grateful for any thinking on it.

[MischiefMonster]

Found the answer! Just posting for completeness. All was fine on the switches, wrong port on the firewall! GUI and the box itself take different numbers for the interfaces... Hahaha.