We're trying to put an ACL on our wireless guest subnets on a controller-based wireless system. We're using 2 of the WiSMs. The ACL I used to use in WLSM allowed the guest subnet to the dhcp servers and out to the internet and dropped everything else, but I don't know where I would apply that list now for it to work with all the different vlans and addresses for the WiSMs.