Adding a Guest VLAN to a network (and blocking access to other networks)

To be configured on switch, first create vlan (L2/L3)

(in config mode)

!
vlan 99
name Guest_LAN
!
interface Vlan99
description Guest VLAN
ip address 192.168.99.1 255.255.255.0

!

Create DHCP pool for Guest network

!
ip dhcp pool GUEST_LAN
network 192.168.99.0 255.255.255.0
dns-server 8.8.8.8 198.153.192.1
default-router 192.168.99.1

!

Exclude hosts if required, e.g.

!

ip dhcp excluded-address 192.168.99.1 192.168.99.10

!

Configure required ports for guest VLAN e.g 25 to 48

!
interface range GigabitEthernet1/0/25-48
description Guest User VLAN
switchport access vlan 99
spanning-tree portfast
!

We now need to prevent users from the Guest VLAN from accessing other networks (if required) so we need to first create an extended access list and then apply it to the Guest VLAN interface. We will call this guest-in for this example and we will block access to the networks below.

!
ip access-list extended guest-in
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.0.255.255
deny ip any 192.168.0.0 0.0.255.255
permit ip any any
!

And that is the basic plumbing done for you Guest VLAN. Your router will also need a route to this network and access-list(s) configured.

 

Leave a Reply

Your email address will not be published. Required fields are marked *