Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Internet Only Vlan (5412zl)

SOLVED
Go to solution

Internet Only Vlan (5412zl)

I have been asked to set up a guest vlan for visitors to our company. The vlan is to permit internet access (via 10.0.0.1) but deny access to our corporate network.
I have gone ahead and set the vlan up however I am not sure how to set the access lists to achieve my objective.
Can anyone advise?

Thanks in advance

Andy

I am happy to provide more information (runnning configuration etc) upon request.
2 REPLIES
Mohammed Faiz
Honored Contributor
Solution

Re: Internet Only Vlan (5412zl)

You need to apply the ACL on the router that holds the gateway for the guest Vlan

Your ACL would flow like this:

- deny access to company subnets on your network
- allow access to anything else
- (implicit deny all)

Be aware that for your first rule you may need to allow access to company DNS servers and such (you may want guests to have access to the company website for example) but that depends upon your guest VLAN setup.

You'd then apply this in the "inbound" direction on your vlan (directions are with respect to the router).

So as an example:

#ip access-list extended "GuestAccess"
#deny ip 0.0.0.0 0.0.0.0 192.168.0.0 0.0.255.255
#permit ip 0.0.0.0 0.0.0.0 0.0.0.0 255.255.255.255

# vlan 10 ip access-group GuestAccess inbound

Re: Internet Only Vlan (5412zl)

Mohammed has provided a solution. However for tricky things like Internet Access for guests I would recommend you firewall off the traffic. Our firewall acts as the Gateway for most of our VLANs (all of those that are installed for security reasons) and we deliver the traffic on a tagged link to the firewall. The firewall then handles the control and filtering of the traffic by VLAN.

That advantage is if management or auditors request proof that that the guest LAN cannot access corporate assets and there is not chance that a security incursion (like a virus) on the guest VLAN can effect corporate services.

Also a Firewall is better designed to lock access to limited port ranges...