VLAN Tagging for Guest Network

peteytesting, thanks for the reply!

I get what you're saying about routing functions belonging to the router, but only the wireless AP knows which network/SSID the traffic came from. So it would be the only one that could augment the traffic in any way to let the router know that this traffic came from this SSID and that traffic came from that SSID. This is typically done in the form of VLAN tagging.

The way that I figured it would work, is that the AP would tag the VLAN that the traffic came from before it passes it off to the router. Forcing the VLAN tags at the AP level also has the added benefit that the client, assuming it's capable of tagging, can't just make up it's own and decide which network it wants to be a part of. It's with these VLAN tags that I can have my router do more advanced routing such as allowing certain requests through the firewall, assigning different dhcp realms, etc.

If you can suggest a different way other than VLAN tags though from my upstream router to understand which SSID a set of traffic came in on though, I could probably also work with that as well!

"hi , once in AP mode the theory is that all it is a pure wireless access point and your upstream router is doing the actual routing and vlan functionality. vlan is usually an advanced feature of the router not the ap"

This is inaccurate and a common misconception. APs should have VLAN tagging support per SSID (or at least non-guest and guest). While modern routers do support VLAN technologies, APs and switches through which a given network pass are required to support the same or have compensatory systems where one or more devices does not.

Even in home deployments (that is, SOHO), having VLAN tagging is desirable. Every home network in my opinion should have at least three networks nowadays. While not typcial, my home has the following networks:

* Security: my contracted security system

* Security-Home: my backup security system

* Guest: for guests

* Internal: general family network

* Voice: voip phones/devices

* Risk: for things I must use but don't want to

* Protected: my main servers and dot1x authenticated devices 

* Lab1: a lab I share with my friends/colleagues that ties to virtual networks

* Lab2: another lab like Lab1 based on virtualization

Each of the above have an IP subnet (CIDR) with dedicated security policies. At most of the edge, these methods address VLAN assignment:

* SSID (two SSIDs share a VLAN but the rest do not) 

* RADIUS assigned VLAN

* MAC-based VLAN 

* Port-based VLAN

* Device-tagged VLAN

There are other tecnhniques that can be used as well such as IP-based VLAN assignment.

If one did have VLAN by SSID assignment on the Orbi, the devices upstream of the AP must either leverage one or more of the above features. Normally these are the domain of the switch/bridge (such as MAC and IP based VLAN assignments) or those devices must have enough interfaces if port-based asssignment is the primary means. For example, the router must support the tagging (trunk, at which point an IRB/RVI interface is associated with the VLAN), have enough physical interfaces, and/or leverage alternate technologies (such as MAC VLAN assignment). 

Because this is another Netgear's forum, I will not post to competing products that can perform the roles. However, I will comment that Netgear does sell affordable switches with the features required to do everything I just said.  

Some vendors do use a NATed guest mode but this is a poor handling especially in larger homes if guest mobility is important. Such a mode also pulls certain policy application to the AP where it may not be best suited. 

After having said all that, every vendor including Netgear should have VLAN tagging support in consumer equipment at this point but especially at the AP and router as those are most often directly connected. The year is 2017 - we all benefit by having better security and security is greatly aided by basic network segmentation.

Cheers.

- Matthew Kurowski