wireless guest-net IP before login

[ppellettiere]

We have a wireless guest net and we broadcast it thru-out our hospital.

The problem is with all the IPAD's, IPHONE's, ADROIDS and such roaming

around the hospital we are using all of our Class C IP addresses. Is there a way setup

the WISM to keep the clients  from getting an IP before the client logins? 

[George Stefanick · Accepted solution]

yea, i feel your pain ... We have 2000 guest daily here at our hospital and as you know people just walking by with wifi devices will get an IP.

One way -- Don't broadcast your SSID. Clients would need to manually join your network and then get an IP.

No other way around it in an open "hot spot" easy to access kinda way.

Im sure thats not what you wanted to hear ...

edit: Another way is to open a much larger scope. We have a /21 here and it works fine. We show as many as 3000 scopes out but normally only have 500 - 2000 users AT MAX ... We also shorten the DHCP scopes to 3 hours.

[ppellettiere]

I would prefer to stop broadcasting the SSID but

I don't think management would want to make it

so that a user needs to setup the SSID on their

device. Especially the doctors who use it...

So lower lease times and expand the ip scope.

Thanks for the help!

[Stephen Rodriguez · Accepted solution]

Unfortunately no,not by default anyway. 

Best way to deal with this is short lease timers, say an hour or two, depending on trends you are seeing in your network.

Possibly you could use ISE to identify the type of device and push it to a different VLAN, but if the WLAN is open, anything can attach, and get an IP address.

[daviwatk · Accepted solution]

Lowering the DHCP lease times, as mentioned previously, is probably the best manageable mitigation.  You may also consider changing your SSID to something other than a generic name such as "Guest" or "Default", etc, assuming that is the case currently.  Some client devices will be attracted to generic SSIDs and initate a connect attempt without user interaction.

If neither of these options are feasible or remedy the issue, your only recourse would be to expand the lease range/network size of this guest network.

[ppellettiere]

I would prefer to stop broadcasting the SSID but

I don't think management would want to make it

so that a user needs to setup the SSID on their

device. Especially the doctors who use it...

So lower lease times and expand the ip scope.

Thanks for the help!

[thomas03usmcsf]

You could also give your clients private ip addresses and then NAT them. This would enable you to have much bigger networks for guest clients.

Sent from Cisco Technical Support iPhone App