What security risk is a GUEST VLAN?

I have 802.11q appliances (AP's, switch, and internal NIC on server). I
want to provide Guest access to the internet, and LAN access to staff and
designated others (to whom I'd give a domain account). I don't have the H/W
to set up separate WLAN's - one for the LAN on the internal side and a GUEST
on the external side.

So ... can I setup the AP's as domain clients, locking them down with WPA
and RADIUS, but still provide GUEST access via a VLAN and appropriate SSID?

[The appliances: D-Link products - DWL-2200AP as the access points, and
DES-3828 as the switch.]

--
Mike Webb
Platte River Whooping Crane Maintenance Trust, Inc.
a 501 (c)(3) conservation non-profit organization

Thanks. The router is a "no-name" brand frm Amer.com, model BR4. Haven't
run across the term/acronym DD-WRT so I'll look it up to see what you are
referring to. As for the firewall, It's Microsoft's ISA 2004, fully patched.
The AP's are D-Link DWL-2200AP's, the switch is D-Link DES-3828, wireless
mode supported - 802.11b and 802.11g. AP's, switch and internal NIC are
com,pliant with 802.11q.

Mike
"Gary Harmon" <gharmon1@(REMOVE)kc.rr.com> wrote in message
news:(E-Mail Removed)...
> On Tue, 3 Jul 2007 13:40:48 -0500, "Mike Webb"
> <(E-Mail Removed)> wrote:
>
>>I have 802.11q appliances (AP's, switch, and internal NIC on server). I
>>want to provide Guest access to the internet, and LAN access to staff and
>>designated others (to whom I'd give a domain account). I don't have the
>>H/W
>>to set up separate WLAN's - one for the LAN on the internal side and a
>>GUEST
>>on the external side.
>>
>>So ... can I setup the AP's as domain clients, locking them down with WPA
>>and RADIUS, but still provide GUEST access via a VLAN and appropriate
>>SSID?
>>
>>[The appliances: D-Link products - DWL-2200AP as the access points, and
>>DES-3828 as the switch.]
>
> Not knowing what brands and models of wireless equipment you have no.
>
> You can however put the WLAN on it's own VLAN and route it to the
> Internet only. Then on your firewall allow VPN out and back in (
> called looping ) then configure the 2003 server for VPN for your
> users.
>
> The other way is to replace the APs with a wireless router that will
> take the DD-WRT firmware then you can configure two SSIDs on VLANs and
> then set your firewall up for that.
>
> Give more information and maybe we can come up with a solution.
>
> I have a wireless mesh network setup running 3 SSIDs and VLANs at my
> work. The equipment is expensive but worth every penny ( Strix Systems
> http://www.strixsystems.com ). Total cost $60,000.00 to cover 1 city
> block outside and 600,000 sq ft building w/2 floors.
>
> At home I use a Linksys WRT54G with DD-WRT set up with 2 SSIDs. 1 SSID
> has access to my 2003 server and the other only Internet access for
> guests. The guest SSID has a login page that comes up when you try to
> access the Internet. Total cost $50.00 about.
>
> Things that we need to know are:
>
> Brand and model of your APs D-Link DWL-2200AP
> DD-WRT only seems to support routers but I've heard of it working
> on some APs. You can check the web site for routers that have been
> tested. http://www.dd-wrt.com. Routers can be had for around $50.00
>
> Firewall make and model
>
> The 2003 will have to setup with ISA to get Radius. The APs or Routers
> will have to support Radius also (WPA-Enterprise).
>
> Hope this helps some
>
> Gary Harmon
>

Thanks.

"Gary Harmon" <gharmon1@(REMOVE)kc.rr.com> wrote in message
news:(E-Mail Removed)...
>I had to get on the web and do some research on the D-Link stuff, I
> have not used D-Link for a few years. I couldn't find out how to
> configure the VLans in the APs but D-Link's web site lead me to
> beleive that you can do VLans on the DWL-2200AP's but did not say
> anything about being capable of 2 or more SSIDs. Worst case is use a
> dedicated AP for the guest SSID and configure a VLAN for it and route
> it to the internet only.
>
> Maybe some else has seen the DWL2200AP that can shed some light.
>
>
>
> On Thu, 5 Jul 2007 07:56:56 -0500, "Mike Webb"
> <(E-Mail Removed)> wrote:
>
>>Thanks. The router is a "no-name" brand frm Amer.com, model BR4. Haven't
>>run across the term/acronym DD-WRT so I'll look it up to see what you are
>>referring to. As for the firewall, It's Microsoft's ISA 2004, fully
>>patched.
>>The AP's are D-Link DWL-2200AP's, the switch is D-Link DES-3828, wireless
>>mode supported - 802.11b and 802.11g. AP's, switch and internal NIC are
>>com,pliant with 802.11q.
>>
>>Mike
>>"Gary Harmon" <gharmon1@(REMOVE)kc.rr.com> wrote in message
>>news:(E-Mail Removed). ..
>>> On Tue, 3 Jul 2007 13:40:48 -0500, "Mike Webb"
>>> <(E-Mail Removed)> wrote:
>>>
>>>>I have 802.11q appliances (AP's, switch, and internal NIC on server). I
>>>>want to provide Guest access to the internet, and LAN access to staff
>>>>and
>>>>designated others (to whom I'd give a domain account). I don't have the
>>>>H/W
>>>>to set up separate WLAN's - one for the LAN on the internal side and a
>>>>GUEST
>>>>on the external side.
>>>>
>>>>So ... can I setup the AP's as domain clients, locking them down with
>>>>WPA
>>>>and RADIUS, but still provide GUEST access via a VLAN and appropriate
>>>>SSID?
>>>>
>>>>[The appliances: D-Link products - DWL-2200AP as the access points, and
>>>>DES-3828 as the switch.]
>>>
>>> Not knowing what brands and models of wireless equipment you have no.
>>>
>>> You can however put the WLAN on it's own VLAN and route it to the
>>> Internet only. Then on your firewall allow VPN out and back in (
>>> called looping ) then configure the 2003 server for VPN for your
>>> users.
>>>
>>> The other way is to replace the APs with a wireless router that will
>>> take the DD-WRT firmware then you can configure two SSIDs on VLANs and
>>> then set your firewall up for that.
>>>
>>> Give more information and maybe we can come up with a solution.
>>>
>>> I have a wireless mesh network setup running 3 SSIDs and VLANs at my
>>> work. The equipment is expensive but worth every penny ( Strix Systems
>>> http://www.strixsystems.com ). Total cost $60,000.00 to cover 1 city
>>> block outside and 600,000 sq ft building w/2 floors.
>>>
>>> At home I use a Linksys WRT54G with DD-WRT set up with 2 SSIDs. 1 SSID
>>> has access to my 2003 server and the other only Internet access for
>>> guests. The guest SSID has a login page that comes up when you try to
>>> access the Internet. Total cost $50.00 about.
>>>
>>> Things that we need to know are:
>>>
>>> Brand and model of your APs D-Link DWL-2200AP
>>> DD-WRT only seems to support routers but I've heard of it working
>>> on some APs. You can check the web site for routers that have been
>>> tested. http://www.dd-wrt.com. Routers can be had for around $50.00
>>>
>>> Firewall make and model
>>>
>>> The 2003 will have to setup with ISA to get Radius. The APs or Routers
>>> will have to support Radius also (WPA-Enterprise).
>>>
>>> Hope this helps some
>>>
>>> Gary Harmon
>>>
>>