Gäste WLAN: DHCP am entfernten Standort

Hallo,

ich gehe davon aus, dass dieser Aufbau nicht funktionieren kann.

Separate Zone durch einen IPsec Tunnel funktioniert nicht. Nur Bridge to AP (V)LAN. 

Hallo Geo,

(Sorry, my German-speaking brain isn't creating thoughts at the moment. )

I'm going out on a limb to disagree with MBP.  I think you only need to add 1.2.3.4 to the tunnel to be able to use Separate Zone Wireless Networks.

MfG - Bob (Bitte auf Deutsch weiterhin.)

Hi Bob,

did you ever get this working? 

I mean - Yes you will see the AP - Yes, the AP will get the configuration and broadcast the Wireless Network - but the traffic of AP to UTM is not getting carried through the IPsec. 

This is my observation after couple of setups. Always switched to VLANs or RED Tunnel. 

The Point is, the traffic seems to be routed wrong of the AP. So basically the same behavior like here. The AP is there and UTM can see the AP and push him config. But the Traffic of the separate zone seems not to be routed to the management UTM. 

Hallo ManBearPig,

der Wechsel bringt mir aber keine wirkliche Abhilfe, wenn ich die Hotspot Option in Verbindung mit Vouchers einsetzen möchte.

Ich kann zwar über die VLAN das DHCP vom Lancom erledigen lassen, aber ich sehe gerade nicht die Möglichkeit es über den VPN zu UTM durchzureichen.

Übersehe ich etwas oder ist es mit dem Vouchern nur in Verbindung mit Sophos RED möglich?

Gruß

Geo

Für VLAN Ports am entfernten Standort benötigst du eine VLAN Bridge. Oder der Lancom Switch übernimmt das und routed es ohne Tag weiter. 

https://community.sophos.com/kb/en-us/132608

It has been a coupla years since I tried this, MBP, but I think it does work.  Unfortunately, I just had to use a RED tunnel for a client for another reason, so I couldn't test.

MfG - Bob (Bitte auf Deutsch weiterhin.)

Wäre eine GRE Verbindung eventuell eine Lösung?

Eine RED, die auf dem VPN läuft, wäre zwar eine machbare Lösung, aber mit weiteren Kosten verbunden.

Gruß

Geo

I have to raise this one from the grave...

I'm not sure if the AP is responsible for that problem. I have 2 customers, where "separate zone" networks are used over site-to-site VPNs. But those VPNs are not built with the UTM that has the wireless protection. They are built with Cisco ASA firewalls and it runs without any issue. In both installations the routing is solved over the LAN-facing interface and another IP in the same subnet as the LAN interface.

Another customer has now UTM's IPSec site-to-site VPN and wireless protection on one device of 3. There I have now the problem with the "remote APs" being successfully connected to the "main" UTM, site-to-site VPNs up without an issue and broadcasting the Bridge-to-AP-LAN wireless network with no issue. Only the separate zone network does not work.

Did anyone find ever a solution for this problem? I guess it has to be searched more in the IPSec VPN direction rather than the AP direction. Maybe a MTU problem because of the additional encapsulation for separating the traffic?