topic Guest WLAN exception in SmartZone and Virtual SmartZone

Guest WLAN exception

ashour_shamoon — Mon, 13 Sep 2021 18:32:44 GMT

Hello,

I have two WLANs in my zone. One for our employees and one for guests/ employee mobile devices.

We wanted to have a Guest WLAN that was isolated and we wanted mobile devices on it as well. The issue I am having is that when people are not at their desk but a different office or building, they cannot access their email (we have an on-site email server).

I have tried to do a whitelist exception but cannot because I am running DHCP/ NAT services. Is there another option? I was thinking maybe a L3 Access Control policy?

Re: Guest WLAN exception

syamantakomer — Mon, 13 Sep 2021 20:09:36 GMT

Hi,

In this case you can create a standard WLAN and then create the isolation using L3 ACLs. This is the only way.

Re: Guest WLAN exception

ashour_shamoon — Tue, 14 Sep 2021 07:11:58 GMT

Ok, that is what I was starting to think...

I do have a question though, I am using a Virtual SmartZone, On the L3 Access Control, can I do a range of IPs? or would this have to be a 1:1?

Re: Guest WLAN exception

ashour_shamoon — Thu, 16 Sep 2021 04:17:00 GMT

I guess what I am trying to figure out is

1) Do I NEED to use the source/ destination ports?

2) Source IP: Is this the Network ID/ Subnet or the device IP and Subnet?

3) Destination IP: Destination IP/ Subnet of Server I am trying to get to?

Re: Guest WLAN exception

syamantakomer — Fri, 17 Sep 2021 14:45:23 GMT

Hi Ashour,

If you use the toggle button, it will change the setting between single port/IP vs range.

For example, if you Turn Off the Source IP button, it will let you define single IP address. If you turn it On, you can configure whole subnet.

If you don't want to define any ports, you can leave it, because it is not a mandatory field.

If you use the combination, then access rule will be more specific.

For example, if you use source and destination both addresses, then system will allow/deny the traffic based on source and destination IP.

If you just use source or destination IP, then rule will be applicable accordingly.

Re: Guest WLAN exception

ashour_shamoon — Mon, 27 Sep 2021 01:35:56 GMT

The one part I am having trouble figuring out still is this, I have a Virtual Machine running on VCenter that I want to be able to access, but not anything else. When I make my policy, I would have to make rules to allow me to get to the IP of VCenter and the Virtual Machine I am wanting to get access to?

Re: Guest WLAN exception

syamantakomer — Mon, 27 Sep 2021 18:56:26 GMT

@ashour_shamoon I think only allowing DHCP, DNS and VCenter server IP should be enough. No need to use source and destination, just add these on destination and choose Direction as bi-directional