Free internet access with restrict access company resource

[YenLin]

Hi all,

Is there any method that we can config on MSM controller to let clients only be able to access internet, but not allow them to access others?

[OliverS_1]

yes you can do that wih a new vsc and authentication local users via html. tunnel always client traffic must be enabled.

in ths vsc you can also define the network for the users.

kind regards

oliver

[oweng]

what's the function of always tunnel client trafffic?

[YenLin]

Hi thanks for the reply,

But what we want to accomplish is users are guest.

We don't want to have any username, Password or authtication for them.

Is there any method that we can use a VSC and only allow them to access internet only?

[Arimo]

Yes, that's possible. Have a look at the Implementation Guide, http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02682324/c02682324.pdf

[Arimo]

About tunneling client traffic, from the controller online help:

Client data tunnel

(Only available when Access control is enabled.)

When a VSC is access-controlled, client traffic that is sent between the AP and controller can be carried in the client data tunnel. This provides the following benefits:

• User traffic is segregated from the backbone network and can only travel to the controller.
• Underlying network topology is abstracted enabling full support for L2-connected users across routed networks.

The client data tunnel is always used when the connection between a controlled AP and its controller traverses at least one router. The client data tunnel supports NAT traversal, so it can cross routers that implement NAT.

Optionally, the client data tunnel can also be used when a controlled AP and its controller are on the same subnet. To do this, enable the Always tunnel client traffic option.

Performance and security settings for the client data tunnel can be customized by selecting Controller >> Controlled APs > Client data tunnel.

Always tunnel client traffic

Use this option to manually force wireless client traffic into the client data tunnel, even when an AP is on the same layer 2 subnet as the controller.

[Juggyv]

I do this by having a trunk/tag on the AP port. One for corporate and one of guest. The guest is a simple broadband router usually so this gives out the dhcp/dns. You need to configure a egress vlan on the profile to match the vlan you use for the internet. I do not always layer 3 the vlan for the internet as I do not want it to become part of the routing domain but an access list can help you here too