Securing network from 'Guest' wireless

[jgorman1977]

We have a vlan created for 'guest' wireless, but I am unsure of how to route them to the internet and keep them out of our production network.

They have their own subnet and terminate into a layer 3 catalyst. Do i need to implement vlan acl's or just point them to the internet vlan when they arrive at the catalyst?

Thank you

[gus.dalinis]

I've got mine setup with a seperate VLAN right to the firewall (ASA5520). If your firewall is VLAN capable, create a new VLAN interface on the firewall and route all the traffic to it. Then put in deny rules for your inside subnets and allow rules for any after.