Cisco ASA Configurations for Newbies : Enabling “Guest” VLAN’s
So, at the hospital and corporate offices, I wanted to setup our wireless access points to have both a “private” domain-connected link AND a “public” guest-access link for visitors. This way, contractors, vendors, clients, etc can bring their laptops in and get Internet access, and employees can connect to the server without intruding on each other.
Our firewall device is a Cisco ASA 5505, and since I have two Cisco Aironet AP’s, I have them connected to the ASA’s PoE switch and mounted in the ceilings at the office.
The AP’s are easy to configure… just configure the SSID’s to use the right VLAN’s that will be configured on your ASA. It’s the ASA that is tricky, because there’s a pretty hefty pre-requisite for it—you MUST be licensed for the Security Plus package in order to take advantage of trunking and multiple VLAN’s. You’ll also want it to have unlimited user licensing too.
In the example below, I use VLAN 1 (for my “outside” VLAN), 2 (for my “inside” VLAN), and 3 (for my “GUEST” VLAN). Once you have that decided on, Telnet or SSH to your ASA, login, and enter “enable” mode and “configure terminal” to get started, then type these in:
interface Vlan3
nameif GUEST
security-level 50
ip address 192.168.1.1 255.255.255.0
interface Ethernet0/6
description Trunk Port for Wireless AP
switchport trunk allowed vlan 2,3
switchport mode trunk
interface Ethernet0/7
description Trunk Port for Wireless AP
switchport trunk allowed vlan 2,3
switchport mode trunk
dhcpd address 192.168.1.100-192.168.1.200 GUEST
dhcpd enable GUEST
nat (inside) 1 0.0.0.0 0.0.0.0
nat (GUEST) 1 192.168.1.0 255.255.255.0
The “interface Vlan3” section configures the GUEST VLAN, the two “interface Ethernet0/*” sections configure the two PoE ports on the ASA as trunk ports that will accept traffic from VLAN’s 2 and 3 (inside and guest), and the dhcpd commands enable DHCP on the Guest VLAN with a 192.168.1.100-200 IP range (101 clients, just in case the dalmations want to use their laptops). If your AP’s are connected to switches rather than the ASA, you need to issue all of these commands (except the dhcpd commands) on the appropriate switches and switch ports as well.
Oh, and if you’re like me, you probably use ASDM more often than the command line… you can copy/paste the entire code segment above into the Tools > Command Line Interface > Multiple Commands option.
That’s it. Since the Guest VLAN has a security level of 50, it shouldn’t overlap with your Inside VLAN (which is usually 100), and the ASA will automatically configure the appropriate access lists (although any specialized needs will need to be done on your own).