I85PREP
⌘ K
Cisco ENWLSD 300-425 study materials
Cisco ENWLSD 300-425 study resources

Cisco ENWLSD 300-425: Design the wireless network for guest access

Cisco ENWLSD 300-425 · Work through your exam, one topic at a time.

All guide sections

Design the wireless network for guest access

Domain 5: Design the wireless network for guest access

This domain tests guest SSID design, DMZ anchoring, web authentication, firewall policy, and guest traffic isolation. The design goal is simple: guests get internet access and nothing else, and guest traffic never touches the corporate core.

Core design

Create a separate guest SSID mapped to a dedicated guest VLAN. Use a guest anchor controller in a DMZ; foreign controllers tunnel guest client traffic to the anchor, and the anchor connects to the DMZ firewall. Allow only the required ports: CAPWAP control 5246 and data 5247 for APs, mobility tunnel UDP 16666 and 16667 between foreign and anchor, RADIUS 1812/1813 if external AAA is used, and HTTP/HTTPS for the portal. On the guest WLAN, apply an ACL that permits DHCP, DNS, and internet-bound HTTP/HTTPS, and denies RFC 1918 and corporate subnets. Enable peer-to-peer blocking and client isolation.

Authentication and policy

Use web authentication with a local or external portal, consent policy, self-registration, or sponsor approval. Set a session timeout appropriate to the business, and rate-limit guest bandwidth with QoS. For higher security, use a guest portal with ISE and sponsor workflows; avoid shared WPA2-PSK for guests because it provides no accountability and is easily leaked.

Worked example

A company expects 500 visitors per day and wants no corporate access. Design one guest SSID on all foreign controllers, mapped to VLAN 100, anchored to a DMZ anchor pair. The firewall permits UDP 16666/16667 from the foreign controllers to the anchor, and the guest ACL permits DHCP, DNS, and TCP 80/443 while denying 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Web auth uses an 8-hour timer and 2 Mbps per client. The reasoning: the anchor keeps guest traffic off the corporate network, the ACL enforces policy even if the SSID is shared, and the timer limits stale sessions.

Traps

  • Placing the guest anchor inside the corporate network instead of the DMZ.
  • Forgetting firewall pinholes for mobility tunnels.
  • Using the corporate VLAN for guests.
  • Writing an ACL that permits all IP after authentication.
  • Forgetting DHCP and DNS in the guest ACL.
  • Not sizing the anchor for peak guest throughput.