SRX5308 How to isolate some clients so they have internet only and can't contact peers

Question

We are a small business with an SRX5308.

I have a basic, consumer WiFi router also hooked into it.

What I want to know, is if there is a way to configure these so that known work computers on the WiFi can access the LAN but guests can only get to the internet and not our LAN (so they can't get to our servers for example).

I'm wondering if I did static IPs for all computers and then told it everything within the DHCP IP Range were assumed to be guests and not allowed to access network resources perhaps? Then I can plug the WiFi router in as an AP to just link up to the SRX5308 DHCP server.

I was able to set up separate VLANs so that the WiFi Router could get online but couldn't access any network resources at all, but I'm hoping to allow SOME users to get to the network and others not. I guess in theory I could throw a second cheapo router on a different VLAN and have that router be exclusively guests and not share the password to the other one if I have to.

Is this possible to do somehow?

DaneA · Answer

Hi&nbsp;GDRitter,

&nbsp;

Welcome to the community! :)&nbsp;

&nbsp;

Setting up VLANs on the SRX5308 is correct in order to separate the guest network from the private network. &nbsp;However, the SRX5308 does not have the option to tag/untag ports. &nbsp;Also, is&nbsp;the WiFi router that you have a&nbsp;VLAN-aware device? &nbsp;

&nbsp;

Here is a network setup that I suggest:

&nbsp;

From the network diagram above, the Private VLAN and Guest VLAN should be configured on both SRX5308 and GS110TP. &nbsp;As you observe, port 1 of the SRX5308 is connected to port 8 of the GS110TP. &nbsp;Port 8 of the GS110TP should be configured as a tagged port to establish a trunk link between the&nbsp;SRX5308 and GS110TP. &nbsp;Port 1 of the GS110TP is connected to the LAN port of the WAC730. &nbsp;Port 1&nbsp;of the GS110TP should be also configured&nbsp;as a tagged port because the WAC730 is a VLAN-aware device. &nbsp;Tagging the ports is needed in order to identify which&nbsp;VLAN&nbsp;the packet belongs to. &nbsp;The ports of the GS110TP connected to the PCs are configured as untagged ports since the PCs are not-VLAN-aware devices. &nbsp;The laptops and PCs are set as members of their respective VLANs. &nbsp;

&nbsp;

I recommend you the WAC730 access points because you can create a wireless network and dedicate a VLAN to it. &nbsp;For example, create a Guest wireless network that is dedicated to the Guest VLAN. &nbsp;Also, the WAC730 can be powered on through its LAN port. &nbsp;For more information about its specification, check its data sheet&nbsp;here. &nbsp;

&nbsp;

I recommend the GS110TP smart switch because it supports VLAN as well as PoE (Power over Ethernet) on all 8 LAN ports. &nbsp;For more information about its specification, check its data sheet&nbsp;here.

&nbsp;

Regards,

&nbsp;

DaneA
NETGEAR Community Team

DaneA · Answer

GDRitter,

&nbsp;

Let me inform you that the WNDR3400 router (even if its configured as an access point) does not support VLAN. &nbsp;The reason why it works when you connect the WNDR3400 to port 4 of the SRX5308 which is a member of VLAN 2 is because the static IP address set on the WNDR3400 is within the IP range of VLAN 2 configured on the SRX5308. &nbsp;The moment you connect the WNDR3400 to other ports (ports 1-3) of the SRX5308, it will not work because ports 1-3 belongs to the default VLAN 1 which has a different IP range. &nbsp;

&nbsp;

Pertaining to your current network setup, here are my suggestions:&nbsp;

&nbsp;

a. Add another WNDR3400 router configured as an access point and dedicate it only for VLAN 1. &nbsp;Or,&nbsp;

b. Replace the WNDR3400 with an access point wherein you can create&nbsp;a wireless network dedicated to each VLAN. &nbsp;If you will choose this option, refer again to my suggested network setup. &nbsp;You could still use&nbsp;your existing GS748T switch for the network setup I suggest. &nbsp;However, since&nbsp;the GS748T doesn't support PoE, I suggest you the WN203 access point. &nbsp;Check the WN203 specifications&nbsp;here. &nbsp;

&nbsp;

Regards,

&nbsp;

DaneA

NETGEAR Community Team

GDRitter · Answer

Here's an image of what I tried to set up but it's not working.

I have two different VLANs. One is our local LAN (VLAN1 / Default) and the new one is intended for internet only access (VLAN2 / Guests) and won't talk to the other VLAN.

I configured the WIFI Router to a static IP through the VLAN2 gateway. If WiFi Router is plugged into a LAN Port on SRX5308 which has the VLAN2 set as default for the port, then it works as expected. You get internet access only and can't talk to the other VLAN.

However, if WiFi is plugged into a port that has VLAN1 set as default, it can't seem to connect to VLAN2 and give any access at all, even internet access.

I want to set up the WiFi downstairs near a conference room for guests to get good signal and have it be isolated from our regular network. So it will have to travel via our switch to LAN2.

What am I configuring wrong?

netgear wiring for guests.png

netgear wiring for guests 2.png

GDRitter · Answer

Thanks so much for your help Dane.&nbsp;Could I insert a VLAN aware switch such as GSS108E that then has a port defined VLAN&nbsp;between the GS748T and WNDR3400 to enable what I'm after? I happen to have a GSS108E laying on the shelf and I don't want to spend more $ if I can avoid it.&nbsp;If not, I'll probably just leave the WNDR3400 on LAN4 of the SRX5308 and guests will have a bit weaker signal strength downstairs.&nbsp;Thanks again!

DaneA · Answer

GDRitter,

&nbsp;

If you just wanted&nbsp;the wireless connections downstairs dedicated only for guests, access and follow the steps on the&nbsp;article below:

&nbsp;

How do I set up one or more VLANs between a NETGEAR ProSAFE firewall and a smart switch?&nbsp;

&nbsp;

Note: From the article, the&nbsp;SRX5308 and M4100-12G switch are used. &nbsp;You already have an SRX5308 and you can use your existing GS748T on this setup. &nbsp;Also from the article above, VLAN 1 and VLAN 5 are used an an example. &nbsp;I suggest that you follow all the steps indicated on the article so that we will be in the same pace. &nbsp;The goal here is to have both VLAN 1 (Private) and VLAN 5 (Guest) to have internet access but no access to each VLAN. &nbsp;

&nbsp;

Answer the questions below:

&nbsp;

a. Are you able to access the internet when you connect PC1 to port 6 of the GS748T? &nbsp;If you follow the article, port 6 is on VLAN 1 or Private VLAN.

b. Are you able to access the internet when you connect PC2&nbsp;to port 11&nbsp;of the GS748T?&nbsp;If you follow the article, port 11 is the only port&nbsp;on VLAN 5 or Guest VLAN.

c. From PC1, are you able to get replies when you ping the IP address of PC2?&nbsp;

d. From PC2, are you able to get replies when you ping the IP address of PC1?&nbsp;

&nbsp;

Note: If your answers above are: (a)Yes, (b)Yes, (c)No, and (d)No, it means that you have really followed the steps from the article. &nbsp;Proceed to the next phase below.

&nbsp;

Remember that port 11&nbsp;is the only port&nbsp;on VLAN 5 (Guest VLAN) which is untagged (U) and the rest of the ports of the GS748T belong to VLAN 1 (Private VLAN). &nbsp;Here are the steps below:

&nbsp;

1. Set a static IP address to&nbsp;WNDR3400 (configured as an access point) that is within the IP range of VLAN 5.

2. Connect the WNDR3400 to port 5 of the GS748T.&nbsp;

3. Connect to the SSID configured on the WNDR3400 and check if you are able to go online wirelessly.

&nbsp;

Note: Be reminded that only the Guest VLAN will be able to go online wirelessly. &nbsp;

&nbsp;

Let us know the result.

&nbsp;

Regards,

&nbsp;

DaneA

NETGEAR Community Team

Forum Discussion

SRX5308 How to isolate some clients so they have internet only and can't contact peers

6 Replies

Related Content

guest WLAN isolation

[WNDR3400v3] Wireless Isolation enabled prevents devices access to Internet

Wired AP - SRX5308 - Internet - SRX5308 - Wired AP

Disable AP isolation

Guest network can't access internet when client isolation is enabled

NETGEAR Academy

ProSupport for Business