Add a Separate Wireless Network for Guests
For better network security, it is common to set up an isolated network for guests and separate them from your private network. To achieve this, it requires creating another LAN subnet with the tag-based VLAN feature on the gateway router.
Vigor AP supports multiple SSIDs. We can create different SSIDs for staff and guests and link them to their respective networks by VLAN IDs.
This article demonstrates how to add a separate wireless network for guests on a Vigor AP.
Setup on Vigor Router
1. Go to LAN >> VLAN, check Enable, and configure the VLAN as follows:
- VLAN 0 is for the main
network:
- Include all the LAN ports,
- use the default Subnet,
- leave VLAN tag disabled,
- VLAN 1 for the guest network:
- Include the LAN port which AP is going to connect
- Include SSID 2 if your router has Wi-Fi built-in
- select "LAN 2" for Subnet,
- enable VLAN Tag, and enter a number for VID.
2. Go to LAN >> General Setup, check "Enable" for LAN 2. You may edit the IP range in Details Page.
3. (Optional) If your router has built-in Wi-Fi, go to Wireless LAN >> General Setup to enable SSID 2.
And set up the password for the guest Wi-Fi at Wireless LAN >>Security
The Configuration of the AP
1. Go to Wireless LAN >> General Setup, enable for a second SSID, customize the SSID, and enter the VLAN ID as the same number as we use in LAN profile settings.
2. Set up a password for the Guest SSID at Wireless LAN >> Security.
Verify the Configuration
Connect the AP to the router. Now, clients connecting to the guest SSID should get an IP in the range in the new LAN profile.
And they should not be able to ping a host on the main network.
Create a Guests network on the Vigor Router
1. Go to Configuration / LAN. Create LAN interfaces and VLANs as follows:
Main Network for Staff
- LAN: LAN1
- VLAN Name: Default VLAN
- VLAN ID: 1
Guest Network
- LAN: LAN2
- VLAN Name: Guests
- VLAN ID: 5
2. In the Interface VLAN tab, configure the LAN port that the AP will connect to.
- Make sure the port type is set to Trunk.
- Set up untagged and tagged VLANs. In this example, VLAN ID 1 is a untagged VLAN for the main network, while VLAN ID 5 is a tagged VLAN for the guest network.
- Set VLAN ID to 5.
- Enter a name for this VLAN ID.
- Select [LAN]LAN1.
- Enter the SSID name.
- Select Enabled.
- Select the security method and enter a password.
- Select the VLAN ID added in step 1.
- Apply the SSID to the desired band.
Add an SSID for Guests on the AP1062C
1. Go to Configuration / LAN. In VLAN List tab, add a VLAN ID and configure it as follows:
Then click Apply to save the settings.
2. Go to Configuration / Wireless LAN. In SSID tab, add an SSID for guests and configure it as follows:
Then click Apply to save the settings.
Verify the Configuration:
When the WiFi client connects to the guest SSID, it should get an IP from router's LAN2 interface.
The client should not be able to ping a host on the main network.
The Configuration of the Router
1. Go to LAN >> General Setup to add a new LAN profile for guests.
2. Set up the LAN profile as follows:
- Enter the profile name
- Check Enable
- Enter a number for VLAN ID
- Set up the IP Address and Subnet Mask
- Select "Enable" for DHCP Server and enter the IP range for guests at DHCP Start IP and DHCP End IP
- Click Apply to save the profile
3. Go to LAN >> Switch to add a VLAN for guests.
4. Enter VLAN ID as the same number as in the LAN profile, add the port to which the Wireless AP will be connecting into Member.
The Configuration of the AP
1. Go to Wireless LAN >> General Setup, enable for a second SSID, customize the SSID, and enter the VLAN ID as the same number as we use in LAN profile settings.
2. Set up a password for the Guest SSID at Wireless LAN >> Security.
Verify the Configuration
Connect the AP to the router. Now, clients connecting to the guest SSID should get an IP in the range in the new LAN profile.
And they should not be able to ping a host on the main network.
Published On:2018-11-16
ShareWas this helpful?