topic Re: Isolate Guest WiFi in separate VLAN without ZD in Access Points - Indoor and Outdoor

Isolate Guest WiFi in separate VLAN without ZD

MSP — Tue, 13 Sep 2022 08:44:41 GMT

Hello Everyone!

We have a mesh network of Ruckus R510 and R610. We have a work SSID and a second Guest SSID that we want to isolate in a dedicated VLAN.

I read the following documentation https://support.ruckuswireless.com/articles/000001547 but since we don't have Zone Director we tried the following:

What we tried was:
1. We configured each switch PoE port to which each Ruckus is connected to have default VLAN ID 1 in access, for our office work network and VLAN ID 192 tagged.
2. In the Guest WiFi, in the WLAN Priority tab, we set "Access VLAN" to 192 assuming that clients connected to SonarGuest WiFi will be able to connect on VLAN 192.
Unfortunately, with this setup Guest WiFi clients were not able to connect to the DHCP server running in VLAN 192.

Considering that our Ruckus APs are connected to an L3 PoE switch, can you please help what will be the correct Ruckus AP and/or switch port configuration to have the Guest WiFi clients connected to a dedicated VLAN? Do I absolutely need to have Zone Director to achieve the split configuration?

Thank you in advance for your help!

Mario

Re: Isolate Guest WiFi in separate VLAN without ZD

Vineet_nejwala — Fri, 16 Sep 2022 05:40:32 GMT

Hi @MSP

On Ruckus the vlan 1 on WLAN always points to untag vlan on the switchport and any other ID on the vlan tag points to tagged vlan on the switchport. In your scenario the port should be trunk and Vlan 192 should be tagged on switchport, this is the only setting needed and if the clients are still not getting IP you should start running wireshark capture to determine if the clients bootp discovery request is reaching to your DHCP server.

Best Regards

Vineet

Re: Isolate Guest WiFi in separate VLAN without ZD

MSP — Fri, 16 Sep 2022 11:46:42 GMT

Hello Vineet,

In our Ruckus R510, R610 and R750 we don have the options:

"4. Assign VLAN tag to the guest SSID at Configure-> WLANs> Create New/Edit> Advanced Options and enter the Vlan ID."

documented here: https://support.ruckuswireless.com/articles/000001547

Do Ruckus R510, R610 and R750 (these the devices we have) support VLAN isolation for Guest WiFi?

Thank you,

Mario

Re: Isolate Guest WiFi in separate VLAN without ZD

Vineet_nejwala — Tue, 20 Sep 2022 03:18:43 GMT

Hi MSP,

Are these APs in Unleash code or just standalone ? I would be able to help accordingly.

Best Regards

Vineet

Re: Isolate Guest WiFi in separate VLAN without ZD

MSP — Tue, 20 Sep 2022 07:01:40 GMT

Hello Vineet,

They are in Unleashed setup.

Thanks,

Mario

Re: Isolate Guest WiFi in separate VLAN without ZD

Vineet_nejwala — Sat, 24 Sep 2022 03:38:49 GMT

Hi @MSP

Once you create an Guest WLAN a default ACL profile is created, below FYR. Additionally assuming that both VLAN on your setup has inter-Vlan routing done (which means the Vlan 1 can access Vlan 2) you can add the subnet range for Vlan1 on ACL and block.

https://www.youtube.com/watch?v=S3Y1Np_Xpqk

Best Regards

Vineet