topic Re: Free internet access with restrict access company resource in M and MSM Series

Free internet access with restrict access company resource

YenLin — Fri, 26 Jul 2013 07:32:10 GMT

Hi all,

Is there any method that we can config on MSM controller to let clients only be able to access internet, but not allow them to access others?

Re: Free internet access with restrict access company resource

OliverS_1 — Tue, 30 Jul 2013 06:50:54 GMT

yes you can do that wih a new vsc and authentication local users via html. tunnel always client traffic must be enabled.

in ths vsc you can also define the network for the users.

kind regards

oliver

Re: Free internet access with restrict access company resource

oweng — Wed, 31 Jul 2013 04:03:09 GMT

what's the function of always tunnel client trafffic?

Re: Free internet access with restrict access company resource

YenLin — Tue, 06 Aug 2013 00:37:53 GMT

Hi thanks for the reply,

But what we want to accomplish is users are guest.

We don't want to have any username, Password or authtication for them.

Is there any method that we can use a VSC and only allow them to access internet only?

Re: Free internet access with restrict access company resource

Arimo — Wed, 07 Aug 2013 12:18:21 GMT

Yes, that's possible. Have a look at the Implementation Guide, http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02682324/c02682324.pdf

Re: Free internet access with restrict access company resource

Arimo — Thu, 08 Aug 2013 11:51:51 GMT

About tunneling client traffic, from the controller online help:

Client data tunnel

(Only available when Access control is enabled.)

When a VSC is access-controlled, client traffic that is sent between the AP and controller can be carried in the client data tunnel. This provides the following benefits:

User traffic is segregated from the backbone network and can only travel to the controller.
Underlying network topology is abstracted enabling full support for L2-connected users across routed networks.

The client data tunnel is always used when the connection between a controlled AP and its controller traverses at least one router. The client data tunnel supports NAT traversal, so it can cross routers that implement NAT.

Optionally, the client data tunnel can also be used when a controlled AP and its controller are on the same subnet. To do this, enable the Always tunnel client traffic option.

Performance and security settings for the client data tunnel can be customized by selecting Controller >> Controlled APs > Client data tunnel.

Always tunnel client traffic

Use this option to manually force wireless client traffic into the client data tunnel, even when an AP is on the same layer 2 subnet as the controller.

Re: Free internet access with restrict access company resource

Juggyv — Sun, 25 Aug 2013 17:54:38 GMT

I do this by having a trunk/tag on the AP port. One for corporate and one of guest. The guest is a simple broadband router usually so this gives out the dhcp/dns. You need to configure a egress vlan on the profile to match the vlan you use for the internet. I do not always layer 3 the vlan for the internet as I do not want it to become part of the routing domain but an access list can help you here too