AP Deployment with VLANs and Guest Network

If you have a complex network environment with security and policy requirements for wireless users, you can enable VLANs on the SSIDs for your wireless network. VLANs enable you to apply wireless security policies to each SSID on the Firebox, and to separate network traffic for each SSID on a dedicated VLAN.

With this deployment scenario, there are two primary methods you can use to physically connect your WatchGuard AP to the network:

  • Connect the AP directly to the Firebox on a Trusted, Optional, or Custom network configured as a VLAN interface. You create VLANs on the Firebox for AP management, and for each wireless SSID.

Network diagram of two AP devices connected to two Firebox interfaces

  • Connect the AP to a managed network switch configured with the VLAN information for the related SSIDs. You can also configure the same VLANs on the Firebox, so that you can use the VLANs in firewall policies for each SSID.

Network diagram of two AP devices connected to a switch connected to a Firebox

AP Deployment and Firebox Policies

Wireless users who connect to the SSID for a specific VLAN can access other resources on the same VLAN, but do not automatically have access to resources connected to other interfaces or VLANs in the same security zone, such as Trusted, Custom, or Optional. You must create additional Firebox policies if you want to allow traffic to other interfaces and VLANs.

Custom Interface and Guest Wireless Security

We recommend the Custom interface security zone for the guest wireless interface. By default Custom interfaces are not included in firewall policies, so this is a secure starting point to prevent guest wireless user connections to network resources on a Trusted or Optional network. You must specifically create policies for access for the Custom security zone, including outbound access and access to other interfaces and networks.

Required VLAN Types

To enable VLAN tagging in your AP SSIDs, there are two types of VLANs you must create:

  • Tagged VLANs for SSIDs — The AP uses tagged VLANs to separate wireless traffic from each SSID. You must create a tagged VLAN for each SSID you configure in your wireless network.
  • Untagged VLAN for AP management — The Gateway Wireless Controller on the Firebox discovers and manages all WatchGuard APs through a special management connection. You must create a separate, untagged VLAN to use for management connections to your APs. The AP management IP address cannot be an IP address on a tagged VLAN.

If you enable management communications VLAN tagging in the AP configuration, the Firebox can use a tagged VLAN for management connections to the AP. An untagged VLAN is still required for the initial connection to an AP that has not yet been paired.

You can choose from two different methods to set up VLANs based on where you connect the AP to your network:

  • Connect the AP directly to a Firebox — To connect your AP directly to your Firebox, you must set up VLANs on the Firebox interface that the AP connects to.
    1. On your Firebox, create a VLAN for AP management and VLANs for all wireless SSIDs.
    2. Configure the Firebox interface to send and receive tagged traffic for the VLANs for each of your SSIDs, and to send and receive untagged traffic for the AP communication VLAN.
  • Connect the AP to a managed switch — To connect your AP to a managed switch, you set up VLANs on the managed switch interfaces and on the Firebox interface that the switch connects to.
    1. On your Firebox, create a VLAN for AP management and VLANs for all wireless SSIDs.
    2. Configure the Firebox interface to send and receive tagged traffic for the VLANs for each of your SSIDs, and to send and receive untagged traffic for the AP communication VLAN.
    3. On the switch, configure the interfaces that connect to the Firebox and to the AP to send and receive tagged traffic for the VLANs for each of your SSIDs. Configure the same interfaces on the switch to send and receive untagged traffic for the AP management communications VLAN.

For more information about when and how to configure VLANs for use with WatchGuard APs, go to Configure VLANs for WatchGuard APs.

For more information about how to enable tagged and untagged VLANs on switch interfaces, see the documentation for your switch.

Create VLANs on Your Firebox

In this configuration example, we create three VLANs:

VLAN for trusted wireless access

  • Description — Used for the primary trusted wireless network.
  • VLAN ID — 10
  • Interface type — Trusted
  • IP address — 10.0.10.1/24
  • DHCP range — 10.0.10.2 - 10.0.10.20

VLAN for wireless guest access

  • Description — Used for the guest wireless network.
  • VLAN ID — 20
  • Interface type — Custom
  • IP address — 10.0.20.1/24
  • DHCP range — 10.0.20.2 - 10.0.20.20

We recommend the Custom interface security zone for the guest wireless interface because by default the Custom interface has no access policies and is a secure starting point to prevent guest wireless users from accessing a Trusted or Optional network.

Untagged VLAN for AP Management

  • Description — Used for AP discovery and management by the Gateway Wireless Controller.
  • VLAN ID — 30
  • Interface type — Trusted
  • IP address — 10.0.30.1/24
  • DHCP range — 10.0.30.2 - 10.0.30.20

Create a VLAN for the Trusted Wireless SSID

  1. Select Network > VLAN.
  2. Click Add.

Screen shot of the VLAN Configuration page for VLAN10

  1. In the Name text box, type a name for this VLAN.

    For this example, type VLAN10.
  2. In the Description text box, type a descriptive comment for this VLAN.

    For this example, type VLAN for the trusted wireless network.
  3. In the VLAN ID text box, type a VLAN ID number.

    For this example, type 10.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.

    For this example, select the trusted wireless VLAN interface, Trusted.
  5. In the IP Address text box, type the IP address for the VLAN interface in slash notation.

    For this VLAN, type, 10.0.10.1/24.
  6. On the Network tab, add a DHCP server.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.
    For this VLAN, type 10.0.10.2 and 10.0.10.20.
  8. Select VLAN tag settings for your VLAN interface. In this example, we tag the trusted wireless VLAN traffic.
  9. Click Save to save this VLAN configuration.
  1. Select Network > Configuration.
  2. Select the VLAN tab.
  3. Click Add.

Screen shot of the New VLAN Configuration dialog box for VLAN10

  1. In the Name (Alias) text box, type a name for this VLAN.

    For this example, type VLAN10.
  2. In the Description text box, type a descriptive comment for this VLAN.

    For this example, type VLAN for the trusted wireless network.
  3. In the VLAN ID text box, type a VLAN ID number.

    For this example, type 10.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.

    For this example, select the trusted wireless VLAN interface, Trusted.
  5. In the IP Address text box, type the IP address for the VLAN interface in slash notation.

    For this VLAN, type, 10.0.10.1/24.
  6. Select Use DHCP Server and click Add.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.

    For this VLAN, type 10.0.10.2 and 10.0.10.20.
  8. Click OK to save this VLAN configuration.

Create a VLAN for the Guest Wireless SSID

  1. Select Network > VLAN.
  2. Click Add.

Screen shot of the VLAN Configuration page for VLAN20

  1. In the Name text box, type a name for this VLAN.

    For this example, type VLAN20.
  2. In the Description text box, type a descriptive comment for this VLAN.
    For this example, type VLAN for the guest wireless network.
  3. In the VLAN ID text box, type a VLAN ID number.

    For this example, type 20.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.
    For this example, select the guest wireless VLAN interface, Custom.
  5. In the IP Address text box, type the IP address for the VLAN interface in slash notation.
    For this VLAN, type, 10.0.20.1/24.
  6. On the Network tab, add a DHCP server.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.
    For this VLAN, type 10.0.20.2 and 10.0.20.20.
  8. Select VLAN tag settings for your VLAN interface. In this example, we tag the guest wireless VLAN traffic.
  9. Click Save to save this VLAN configuration.
  1. Select Network > Configuration.
  2. Select the VLAN tab.
  3. Click Add.

Screen shot of the New VLAN Configuration dialog box for VLAN20

  1. In the Name (Alias) text box, type a name for this VLAN.

    For this example, type VLAN20.
  2. In the Description text box, type a descriptive comment for this VLAN.

    For this example, type VLAN for the guest wireless network.
  3. In the VLAN ID text box, type a VLAN ID number.

    For this example, type 20.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.

For this example, select Custom. We recommend the Custom zone because traffic for a custom interface is not allowed through the Firebox unless you specifically configure policies to allow it. This is important for wireless guest network security to make sure guest users cannot access a trusted or optional network.

When you use the Custom security zone, you must specifically add the guest wireless network to your Outgoing policy to allow outbound access to guest wireless users.

  1. In the IP Address text box, type the IP address for the VLAN interface in slash notation.

    For this example, type 10.0.20.1/24.
  2. Select Use DHCP Server and click Add.
  3. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.

    For this example, type 10.0.20.2 and 10.0.20.20.
  4. Click OK to save the VLAN configuration.

Create a VLAN for AP Management

  1. Select Network > VLAN.
  2. Click Add.

Screen shot of the VLAN Configuration page for VLAN30

  1. In the Name text box, type a name for this VLAN.
    For this example, type VLAN30.
  2. In the Description text box, type a descriptive comment for this VLAN.
    For this example, type VLAN for AP management connections.
  3. In the VLAN ID text box, type a VLAN ID number.
    For this example, type 30.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.
    For this example, select the AP communication VLAN interface, Trusted.
  5. In the IP Address text box, type the IP address for the VLAN interface in slash notation.
    For this VLAN, type, 10.0.30.1/24.
  6. On the Network tab, add a DHCP server.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.
    For this VLAN, type 10.0.30.2 and 10.0.30.20.
  8. Select VLAN tag settings for your VLAN interface. In this example, we do not tag the AP communication VLAN traffic.
  9. Click Save to save this VLAN configuration.

When complete, the example VLAN settings looks like this:

Screen shot of the Network > VLAN tab with three VLANs configured

  1. Select Network > Configuration.
  2. Select the VLAN tab.
  3. Click Add.

Screen shot of the VLAN Configuration dialog box for VLAN30

  1. In the Name (Alias) text box, type a name for this VLAN.

    For this example, type VLAN30.
  2. In the Description text box, type a descriptive comment for this VLAN.

    For this example, type VLAN for AP management connections.
  3. In the VLAN ID text box, type a VLAN ID number.

    For this example, type 30.
  4. From the Security Zone drop-down list, select the security zone for this VLAN and SSID.
    For this example, select the AP communication VLAN interface, Trusted.
  5. In the IP Address text box, type the IP address for the VLAN interface in slash notation.

    For this example, type, 10.0.30.1/24.
  6. Select Use DHCP Server and click Add.
  7. In the Starting IP and Ending IP text boxes, type the IP address for the DHCP range.

    For this example, type 10.0.30.2 and 10.0.30.20.
  8. Click OK to save the VLAN configuration.

When complete, the example VLAN settings looks like this:

Screen shot of the Network Configuration > VLAN tab with three VLANs configured

Add VLANs to a Network Interface (Policy Manager)

If you use Policy Manager, you must add these VLANs to a network interface and select your tagging options.

  1. Select Network > Configuration.
  2. Select the Interfaces tab.
  3. Select the network interface to use for VLANs and click Configure.
    The Interface Settings dialog box appears for the selected interface.

Screen shot of the Interface Settings dialog box for the VLAN interface

  1. In the Interface Name text box, type a name for this VLAN interface.
  2. In the Interface Description text box, type a description for this VLAN interface.
  3. From the Interface Type drop-down list, select VLAN.
  4. To receive tagged VLAN data on this network interface, select the Send and receive tagged traffic for selected VLANs check box.
  5. Select the Member check box for each tagged VLAN to include on this interface.
    For this example, select VLAN10 and VLAN20.
    Only the SSID VLANs are tagged. The AP communication VLAN must remain untagged.
  6. To configure the interface to receive untagged data, select the Send and receive untagged traffic for selected VLAN check box.
    To send and receive untagged data for the AP communication VLAN, you must select this option.
  7. From the drop-down list, select the AP communication VLAN, VLAN30, as the untagged VLAN.
  8. Click OK.
  9. Save the configuration file to your Firebox.

Add SSIDs to the Gateway Wireless Controller

  1. Select Network > Gateway Wireless Controller.
  2. Select the Enable the Gateway Wireless Controller check box.

  3. On the SSIDs tab, click Add.

Screen shot of the Add SSID page for the Trusted SSID

  1. In the Network Name (SSID) text box, type Trusted.
  2. Select the Enable VLAN tagging check box.

    This is required because this SSID VLAN must be tagged.
  3. In the VLAN ID text box, type or select 10.
  4. In the Access Points tab, select the APs that you want to use this SSID.
  5. Select the Security tab.
  6. Configure your wireless encryption security settings for this SSID.
  7. Click Save to save the SSID configuration.
  8. On the SSIDs tab, click Add.

    The Add SSID dialog box appears, with the Settings tab selected.

Screen shot of the Add SSID page for the Guest SSID

  1. In the Network Name (SSID) text box, type Guest.
  2. Select the Enable VLAN tagging check box.
    This is required because this SSID VLAN must be tagged.
  3. In the VLAN ID text box, type or select 20.
  4. In the Access Points tab, select the APs that you want to use this SSID.
  5. Select the Security tab.
  6. Configure your wireless encryption security settings for this SSID.
  7. Click Save to save the SSID configuration.
  1. Select Network > Gateway Wireless Controller.

    The Gateway Wireless Controller dialog box appears, with the SSIDs tab selected.
  2. Select the Enable the Gateway Wireless Controller check box.

  3. On the SSIDs tab, click Add.

    The Add SSID dialog box appears, with the Settings tab selected.

Screen shot of the Add SSID dialg box for the Trusted SSID

  1. In the Network Name (SSID) text box, type Trusted.
  2. Select the Enable VLAN tagging check box.

    This is required because this SSID VLAN must be tagged.
  3. In the VLAN ID text box, type or select 10.
  4. In the Access Points tab, move the APs that you want to use this SSID from the Available list to the Member list.
  5. Select the Security tab.
  6. Configure your wireless encryption security settings for this SSID.
  7. Click OK to save the SSID configuration.
    The Gateway Wireless Controller dialog box appears, with the Trusted SSID in the SSID list.
  8. On the SSIDs tab, click Add.

    The Add SSID dialog box appears, with the Settings tab selected.

Screen shot of the Add SSID dialog box for the Guest SSID

  1. In the Network Name (SSID) text box, type Guest.
  2. Select the Enable VLAN tagging check box.

    This is required because this SSID VLAN must be tagged.
  3. In the VLAN ID text box, type or select 20.
  4. In the Access Points tab, move the APs that you want to use this SSID from the Available list to the Member list.
  5. Select the Security tab.
  6. Configure your wireless encryption security settings for this SSID.
  7. Click OK.

    The Gateway Wireless Controller dialog box appears, with the Trusted and Guest SSIDs in the SSID list.

Screen shot of the SSIDs tab with two SSIDs configured on two VLANs

  1. Click OK to save the Gateway Wireless Controller configuration.
  2. Save the configuration file to your Firebox.

After you have configured the SSID, you can pair any additional APs with the Firebox, and assign this SSID to the radios on each AP.

Related Topics

About AP Configuration

Configure APs with the Gateway Wireless Controller