University SSID and VLAN Design with Guest Isolation
Metro State University is deploying 60 APs in two buildings. The design calls for three SSIDs: Staff (WPA2-Enterprise with RADIUS), Student (WPA2-PSK with a rotating key), and Guest (captive portal). Staff must be on VLAN 110, Student on VLAN 120, and Guest on VLAN 130. The campus DHCP server is centralized and already has scopes for those VLANs. The wireless team wants to keep the guest network isolated from internal resources while still allowing internet access, and they want to avoid putting all 60 APs into one network policy if a future change could disrupt the whole campus. Some classrooms have older tablets that only support 2.4 GHz, and the university wants to discourage staff from connecting to the Student SSID.
1. Design the network policy and SSID-to-VLAN mapping for the campus, including how to limit the blast radius of future changes.
Read the worked answer
Create one network policy per building, or one campus policy with separate building device groups, so a change can be piloted before it reaches all 60 APs. Inside the policy, define three SSIDs with explicit VLAN assignments: Staff uses WPA2-Enterprise with the external RADIUS server and VLAN 110; Student uses WPA2-PSK and VLAN 120; Guest uses captive portal and VLAN 130. Ensure the AP uplink is trunked for all three VLANs and that DHCP relay or the centralized DHCP scopes are reachable from each VLAN. Keep the guest SSID separate from staff and student so firewall policy can be applied per VLAN. If the Student key rotates frequently, consider ExtremeCloud IQ Private Pre-Shared Key or a managed PSK process rather than manually changing a shared key on every AP.
2. How should guest isolation be implemented so guests get internet access but cannot reach internal resources?
Read the worked answer
Do not rely on the SSID name alone. Put Guest on VLAN 130 and enforce isolation at both wireless and wired layers. Enable client isolation on the guest SSID so guest clients cannot talk to each other, and apply a firewall or ACL on the guest VLAN that denies access to internal subnets while permitting DHCP, DNS, and internet-bound traffic. The captive portal should authenticate guests before allowing general access. Test from a guest client by trying to reach an internal server, another guest client, and an internet destination. Also verify that the guest VLAN cannot be used as a management path to APs or switches. This layered approach survives misconfiguration better than a single checkbox and gives the university an auditable policy point at the gateway.
3. The university wants older 2.4 GHz-only tablets to work while discouraging staff from using the Student SSID. What wireless settings and operational controls would you use?
Read the worked answer
Keep the 2.4 GHz radio enabled and do not set a minimum basic rate that locks out older devices. Use band steering to prefer 5 GHz for capable clients, but verify that 2.4 GHz-only tablets still associate. For the Student SSID, use a distinct rotating key or PPSK so staff devices do not automatically join it, and avoid hiding the SSID as a security control because hidden SSIDs complicate support without preventing access. If staff-only areas need tighter control, scope SSID availability by device group where the design allows it, or use RADIUS-based authorization for Staff. Combine technical controls with a clear onboarding policy and monitor which client classes join Student so the university can adjust rather than guess.