Blocking Guest Subnet From Internal Access

[Garrison Gurule]

I have a Cisco 1841 integrated router I am working with and need to know:

How can I prevent a guest network (10.1.6.0/24) from accessing all my internal networks (switches, routers, aps, mainfrains)....

Currently, computers connected to the VLAN:

• get IP addresses, DNS, and DHCP 
• can access all of my internal network
• have access to the internet;

Attached is the config file...

Thank you for your help

[paul driver]

Hello

If they are coming in from you wan interface then:
sh access-list 100 <--- check the sequence numbers after the last deny entry use the next number but it has to be under the first permit number

Example:
20 deny
30 permit

ip access-list extended 100
25 deny ip 10.1.6.0 0.0.0.255 any
exit

res
paul

[Garrison Gurule]

What do you mean by WAN interface, the modem?

My guests will be connecting thru APs I have that are managed by a virtual controller attached to port on my switch.

[Julio E. Moisa]

Hi

Other way is using VRF so this subnet 10.1.6.0/24 will be in other routing table never merged with the global routing table. (unless you want)

:-)

[Garrison Gurule]

VRF sounds good. How would I need to change the current config file and what what would I need to add in order to get this working?

[Julio E. Moisa]

Hi

Where is the gateway for that subnet created?