1

I'm running into an issue setting up a guest VLAN on my Netgear Prosafe switch using a Cisco Aironet 1832i Access Point. The Management VLAN works as expected (issues IP addresses, can access Internet, etc.). However, the guest VLAN 20 can't access the internet. I think it may be some setting/security issue I'm missing. Also note that VLAN 20 cannot ping VLAN 1 addresses.

Any ideas?

-

Comcast Internet Details

  • Comcast Router (Arris)
  • Gateway: 10.0.0.1
  • DHCP Range: 10.0.0.2 -> 10.0.0.125

I've setup the AP as a Controller via Mobile Express with the below settings:

Management VLAN

  • VLAN Management (1)
  • WLAN SSID: Test
  • WPA2
  • VLAN Tagging: No (assumes 1)
  • DHCP: day0-mgmt
  • VLAN: Management Network (1)
  • Network/Mask: 10.0.0.0 / 255.255.255.0
  • Start/End IP: 10.0.0.160 / 10.0.0.185
  • Default Gateway: 10.0.0.1
  • DHCP Server: 10.0.0.185

Guest VLAN

  • VLAN 20
  • WLAN SSID: Guest
  • Open
  • VLAN Tagging: Yes, 20
  • DHCP: day0-testGuest
  • VLAN: 20
  • Network/Mask: 10.0.2.0 / 255.255.255.0
  • Start/End IP: 10.0.2.1 / 10.0.2.250
  • Default Gateway: 10.0.2.1
  • DHCP Server: 10.0.2.250

The issue comes in with the Netgear ProSafe Switch (I think...). Here is how I've got it configured:

SWITCH -> Netgear ProSafe GS516TP IP 10.0.0.12 Subnet 255.255.255.0 Firmware 6.0.1.16

  • Port 1: Comcast Router (Internet)
  • Port 5: Cisco Aironet Access Point #1 (Controller)

Configuration

  • Switching > VLAN > Basic > VLAN: Added VLAN ID: 20 w/ name Guest
  • Switching > VLAN > Advanced > VLAN Membership: Ports 1 & 5 set to "T" for VLAN ID 20
  • Switching > VLAN > Advanced > Port PVID Configuration: ports 1 & 5 set "Ingress Filtering = Disabled" left PVID = 1
  • Routing > VLAN > VLAN Routing > VLAN 20 / IP Address: 10.0.2.1 (Default Gateway for VLAN 20 DHCP) / Subnet Mask: 255.255.255.0
  • Note: Before this the ARP table showed only VLAN 1 (mgmt), after adding 10.0.2.1 it showed all active clients

  • Security > Port Authentication > 802.1x Config: Port Based Auth & Guest VLAN = Disabled (default)

  • Security > Port Auth > Advanced > Port Auth = All Ports = Authorized w/ Guest VLAN Disable

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.