I am trying to create a wireless guest network, but I would like it to be on its separate subnet. People that are on the guest wireless network should not have access to the internal network. I believe I can do this with a vlan. As far as accessing the DNS and DHCP go, they should be able to access a public DNS, and I have to tweak the ACLs so it can either access my DHCP server or use the ASA as a DHCP server (not sure if that even works). Can someone please tell me how I can achieve this?
Hi, To add on Ricks comment ..I have just tried to help you with some example configuration...
You can do trunking between switch and ASA firewall to allow the VLAN at ASA level.
The ASA 5506-X comes with 8 GigE routed interfaces. Normally for small enterprise based on routing you can go with 3 interfaces and based on that you can add interface– inside (100), DMZ(50) and outside (0).
For Example ..
interface GigabitEthernet1/1
description to WAN
nameif outside
security-level 0
ip address 20.1.1.1 255.255.255.0
!
interface GigabitEthernet1/2
description to LAN
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet1/3
description to DMZ
nameif dmz1
security-level 50
ip address 192.168.10.1 255.255.255.0
With trunk enabled at ASA Firewall
int e0/1
no ip address
no security-level
no nameif inside
int e0/1.1
nameif inside
vlan 1
security-level 100
ip address 172.29.1.1 255.255.255.0 standby 172.29.1.2
no shut
int e0/1.2
nameif XXX
vlan 8
security-level 90
ip address 192.168.17.1 255.255.255.0 standby 192.168.17.2
no shut
At switch level ..
Vlan 8
int g9/2
sw trunk encap dot1q
sw mode trunk
sw trunk allow vlan add 8
DHCP configuration at ASA is achievable and can be done by following configuration ..
Specify a DHCP address pool and the interface for the client to connect.
dhcpd address 192.168.10.5-192.168.10.250 inside
dhcpd dns 4.1.1.1 4.2.2.2
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcprelay timeout 60
-GI
