Frank,
Great question. As Steve answered, yes you can do this and here is how.
On your WLC you would create 2 WLANs. The WLANs will be configured to your liking, so WLAN1 is open and WLAN 2 is locked. Another way of thinking of this, think WLAN = Wireless side. In the WLAN config you can MAP which wired side interface you would like this WLAN traffic to land on. You could map both to the same wired side interface. Keep in mind, on the wireless one will be open and the other lock, but the users will get the same IP range and live in the same subnet, because they are both mapped to do so.
Assuming this is an anchor providing guest access, you will have to anchor the WLANs from the foreign to the anchor and anchor the anchor wlans to itself and make sure the configs are identical on the wlan. Read the guest anchoring config example. I would also create a dummy interface on the foreign controllers and anchor the foreign WLANs to them.
http://www.cisco.com/en/US/docs/wireless/technology/guest_access/technical/reference/4.1/GAccess_41.html
On the FW you will need to follow the above like. But in short you will need to open atelast EOIP 97 and 16666 ports. Here is a blog post i outlined ports for office extends, but also applies to anchor.
https://supportforums.cisco.com/community/netpro/wireless-mobility/security-network-management/blog/2012/06/28/cisco-wlc-anchor-controller-dmz-ports-w-officeextends
__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
___________________________________________________________
