Wireless user separation

Question

wireless 1 says this is the most secure and use for admin. &nbsp;How do i separate users on 2 or 3 and make them as secure as wireless 1 ?&nbsp;&nbsp;&nbsp;

schumaku · Answer

Orbi Pro AX model? Associate the Wireless&nbsp;2 and 3 profiles with dedicated VLANs for example.

Orbipro1 · Answer

how is wifi 1 the safest and how do I make the other networks as safe? I read that vlan has leak vulnerabilities. Is the basic router setup a one lan a vlan in itself? Then setting up additional lan/ vlans further separates the users virtually but not physically. Will the networks 2 and 3 be safer with user separation?

It is Orbi Pro AX6000 WiFi 6 Tri-Band WiFi System. Wireless 2 and 3 say :

Allow IoT devices to see each other and access my local network

On

wireless 1 says

Name (SSID)	ORBI30


Broadcast Name	On

Wireless AP	On

if i use advanced setting lan setup to activate lan 2 and assign a VLAN group; then wireless setup and assign wireless network to a VLAN? How does the advanced vlan/bridge Ethernet port setting correspond with the lan and wireless vlan settings? Then will Users or devices not be able to see one another?

My lan Ethernet ports under vlan/bridge settings are setup as access points for the base and one satellite, and vlan is set as default.

when I assigned vlan in lan and wireless setup , separation did not show on advanced home summary screen.

schumaku · Answer

Each VLAN does make a dedicated network. Of course, physically on the same network. Industry standard in the IT industry. Multi-tenant data centers operate VVLAN where each customer has his own full ability to use all VLANs possible. And everything can be on the same physical network. Nothing wrong with this.
&nbsp;
The WiFi client separation is a different thing - it does just prohibit&nbsp;by some clever&nbsp;L2 MAC filtering that wireless clients can communicate direct. That's why you don't see this enabled. For most use case, this is not a feature you want on your wireless...

Orbipro1 · Answer

So lan and vlan are a form of network separation or allocation. Network isolation can be on one or all of the lan by way of a designated vlan on that lan.lan 1 without changes then contains all devices and its default shows no client separation in the vlan bridge settings as default1. &nbsp;And literature says wireless 1 is the most secure and resides on lan1 1 withe the default1 vlan.&nbsp;would I want to assign any of the switches to a vlan with client isolation? Then any device connected to that switch would be governed by the assigned vlan setting? Also a wireless device?&nbsp;The switch settings show a vlan menu, so the communication of wired devices or wireless devices connected to the switch will be affected by the vlan choice and it's setting and will assso if assigned to a vlan then network three, for example, would be on a separate lan with the assigned characteristics of the vlan I'd associated with that lan? Otherwise all wireless networks and wired devices would be on lan 1 and governed by its default or assigned vlan profile?&nbsp;&nbsp;if a wireless network has the vlan activated then it will be assigned to the lan that has the chosen vlan id?&nbsp;if i wanted to prevent a wired desktop, or a unauthorized wireless device from communicating with a device on wireless three, for example, or wireless three devices from communicating with one another then a isolation would be useful?&nbsp;i I found these instructions for separation but only through insight app(I did not want to use insight because seems like remote administration and additional,vulnerability) but bot as simple in web interface.To set up client isolation on your wireless access point using the Insight Cloud Portal:Log in to the Insight Cloud Portal.If you have an Insight Pro account, select a organization.Select a location.Select Wireless &gt; Settings &gt; WiFi and Captive Portal.On the far right of your SSID, click the pencil (Edit) icon.Select Settings.Click the Enable radio button.Click the Broadcast SSID radio button.Click the Client Isolation radio button.&nbsp;

schumaku · Answer

Step back a little bit from this "most secure" wording a little bit and reflect this:&nbsp;
&nbsp;
The idea of the product design and the implementation and the related&nbsp;specific naming of certain controls or status came from the idea to provide a trust model:
&nbsp;
Wireless 1 (highest trust) &gt;&gt; Wireless 2 (BYOD, medium trust) &gt;&gt; Wireless 3 (IoT, low trust)
&nbsp;
This does not mean that the Wireless 1 must have the most strict settings in place - you simply won't give systems access to that network where you don't have the highest trust and confidence.
&nbsp;
&nbsp;
Now let's talk about your question ref. the switches. Assume you think about lightly configurable&nbsp;Plus, smart managed Pro, or even managed switches. Most of these have the ability to configure a management VLAN. This is the VLAN you use for the switch management. No doubts, in an enterprise and expensive business environment, you would operate a dedicated&nbsp;management VLAN. This would make it impossible for the typical workplace computer, and even less for BYOD, guests, .... to reach the network management. This would map to an extended trust model like this:
&nbsp;
Network Management (extreme trust) &gt;&gt; Wireless 1 (highest trust) &gt;&gt; Wireless 2 (BYOD, medium trust) &gt;&gt; Wireless 3 (IoT, low trust) &gt;&gt; Guests (zero trust, restricted Internet only)
&nbsp;
All this does come however with a lot of practical impact. Users need to print. You as the network admin would like to discovery&nbsp;network devices and use management Web and Apps. Mobile devices need discovery and access of media players for playback or screen mirroring. Wireless light and climate/heating controllers need to talk to the related actors (there it goes the isolation for IoJ - you don't want to depend on Internet and cloud availability for these, do you?). And of course you would like to use the nice mobile Apps for light and climate/heating. The network admin needs Web and probably App access to the network devices, and also needs SNMP, TFTP, .... Any many more.&nbsp;&nbsp;Said all that: Of course this does not limit the switch primary intention for dealing with multiple VLANs, tunks or access ports.
&nbsp;

Forum Discussion

Wireless user separation

6 Replies

Related Content

RBK853 with separate wireless backhaul

Bridging to wireless routers together on separate networks

NETGEAR Community User Guidelines

My orbi 970 Mesh satellite has two separate Macs and two separate ip

Separate 2.4ghz on Orbi RBR50v2

NETGEAR Academy

ProSupport for Business