Internet Only Vlan (5412zl)

[andy_johnson(cnews)]

I have been asked to set up a guest vlan for visitors to our company. The vlan is to permit internet access (via 10.0.0.1) but deny access to our corporate network.
I have gone ahead and set the vlan up however I am not sure how to set the access lists to achieve my objective.
Can anyone advise?

Thanks in advance

Andy

I am happy to provide more information (runnning configuration etc) upon request.

[Mohammed Faiz · Accepted solution]

You need to apply the ACL on the router that holds the gateway for the guest Vlan

Your ACL would flow like this:

- deny access to company subnets on your network
- allow access to anything else
- (implicit deny all)

Be aware that for your first rule you may need to allow access to company DNS servers and such (you may want guests to have access to the company website for example) but that depends upon your guest VLAN setup.

You'd then apply this in the "inbound" direction on your vlan (directions are with respect to the router).

So as an example:

#ip access-list extended "GuestAccess"
#deny ip 0.0.0.0 0.0.0.0 192.168.0.0 0.0.255.255
#permit ip 0.0.0.0 0.0.0.0 0.0.0.0 255.255.255.255

# vlan 10 ip access-group GuestAccess inbound

[Chris Sidwell-Smith]

Mohammed has provided a solution. However for tricky things like Internet Access for guests I would recommend you firewall off the traffic. Our firewall acts as the Gateway for most of our VLANs (all of those that are installed for security reasons) and we deliver the traffic on a tagged link to the firewall. The firewall then handles the control and filtering of the traffic by VLAN.

That advantage is if management or auditors request proof that that the guest LAN cannot access corporate assets and there is not chance that a security incursion (like a virus) on the guest VLAN can effect corporate services.

Also a Firewall is better designed to lock access to limited port ranges...