topic Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN in Unleashed

Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

jimmy_van_der_m — Tue, 29 Dec 2015 12:10:39 GMT

The R500 Unleashed publishes its Guest Portal on its management IP address.
We setup a separate VLAN for Guests with only internet-access through a fully separated proxy.
The guests in that separate VLAN are redirected to the (unreachable) management IP address for authentication.

To clarify, here is a larger explaination:
Ruckus Unlaeshed AP has fixed IP address 192.168.0.241.It has no option for VLAN tagging settings on it's management, so on the switch we let it land on the default untagged VLAN 1.
For simplicity, we leave it VLAN 1, which is then also our own internal management network.

We create several WLANs, each with a different VLAN setting.
These are recognized on the swich as Tagged VLANs, so we can fully separate them (separate from each other and from our management network).

One WLAN we use for Guests, so we configure the Ruckus internal Guest Portal.
On the Ruckus, this WLAN is configured with VLAN 2 to be fully separated from management and any other network.
Only the Ruckus and a internet proxy are in this network, connected by the switch on VLAN 2.
To avoid confusion, we use a different IP segment: 10.0.0.x on this network.
(but there is nothing on the Ruckus to make the Ruckus aware of that)

When I use a tablet as Guest device and connect to the Guest WLAN, I get redirected to 192.168.0.241 for entering my Guest code.
Since 192.168.0.241 is not reachable from the 10.0.0.x (because it is not in the same IP segment, not routed AND because we are on a different VLAN), it gives a timeout.
Also, we don't want to make 192.168.0.241 available on the Guest network, because that imposes a huge security risk (it's also the management IP).

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

daniel_m — Tue, 29 Dec 2015 18:29:01 GMT

Hey Jimmy,

While I have a similar scenario—Guest network in an isolated VLAN (environment is routed, but Access Control Lists prevent the guest VLAN from accessing other VLANs)—I have not experienced your issue. While I haven’t looked into this in detail, and I do see that guest’s browsers reflect the management IP, it appears some tricks are being done here as I never actually see any traffic going from the client to the management IP (meaning, I don’t see any traffic going to the management IP over the wire, so this is never being routed and is being handled wirelessly). That said, I’m using “No authentication” for my Guest Access, so this might be different from what you’re doing.

Cheers.

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

jimmy_van_der_m — Tue, 29 Dec 2015 19:38:20 GMT

Hi Daniel, that is exactly why you don't run into this problem, you don't use the internal guest portal for authentication. It is that portal that is unreachable from a different vlan, because it can only be in the management vlan... (because it runs on the ip address of the AP)

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

daniel_m — Tue, 29 Dec 2015 20:04:38 GMT

That’s possible, but my guests do get the Terms of Use screen and must click on “Accept and Continue” before being able to browse. For what it’s worth, I don’t use a proxy—perhaps there’s a chance this is interfering.

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

jimmy_van_der_m — Wed, 30 Dec 2015 21:10:09 GMT

So is there perhaps a form of routing between the guest network and the network where the AP's are configured/managed?

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

louis_philippe_ — Thu, 07 Jan 2016 17:16:11 GMT

I second Jimmy's "feature request" as this is definitely a limitation of the unleashed AP. It has only one IP on the default VLAN for everything, including guest authentication and also for guest pass generation. This is also a security issue as I would like to keep the management IP in a dedicated management VLAN which is not accessible by users, then have the guest login and guest pass generation web pages on another VLAN, maybe even two separate VLANs.

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

jonhan — Mon, 08 Jan 2018 18:06:27 GMT

This was never resolved?? It seems like an important distinction that should be clarified.

Re: Unleashed: Separate Guest VLAN but GuestPortal only in Default VLAN

felix_winter — Mon, 24 Jan 2022 13:25:07 GMT

I want to bring this up again. Running Firmware 200.12.10.5.234 on a H550.

In the unleashed Dashboard I can choose for Guest Network under WLAN Priority different VLAN (default 1).

I can set 3 as it is my VLAN for Guest as set in the firewall/router 192.168.3.1/24 range.

But the acces portal still use the number 2 range of the AP IP 192.168.2.1/24 . I would like to hide this network.

I can denay acces with roules

Any documentation how the VLAN feature should be used correctly?

thank you.

PS I just switched my WAP from outdated Xclaim to up to date ruckus WAP.