How locked down is the Guest WLAN setting (default-guestservice)?

[zack_brantley]

We have a guest SSID and it works well. We are using the isolation feature and everything seems to be blocked. My only concern is I don't know for a fact that everything is blocked. For example, we have no rules to allow DHCP requests go through, yet guest clients are getting a valid DHCP address. Secondly, we don't have an ACL to allow DNS requests to our internal DNS server, yet guest clients are querying our internal DNS servers successfully. Lastly, we have an ACL rule to deny 10.0.0.0/8 access from the guest SSID, which I would think would deny DHCP, DNS, etc. since our DHCP and DNS servers reside in that network.

In a nutshell, can someone tell me what access is allowed by default for the guest profile and why does our 10.0.0.0/8 deny rule not block everything for guests?

Thanks!

[zack_brantley]

Ok, so it sounds like the access points are the "firewall" in this case, blocking access to other parts of our network when on the Guest SSID. I have a deny in place on the guest SSID for 10.0.0.0/8, so that nothing can go to other parts of our network. With that said, it sounds like ARP, DHCP, and DNS will ignore that rule. Are there any other protocols that ignore the deny rules?

[michael_brado]

No, just specifically and only those three.