This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Asking for Help to Configure Wireless Network

I just replaced our old Apple "AirPorts" with Sophos AP 100C access points. When I enabled Wireless Protection I did the following:

  • Enabled Wireless Protection with "Internal" as the allowed interface.
  • Created a matching wireless network, Bridged to the AP LAN, which is our internal network, the same LAN where the access points are connected.
  • Activated the access points, set the 2.4 and 5 Ghz channels to match the Apple access points they replaced to minimize interference with each other and nearby unrelated "neighbor" access points.

At this point, we have the equivalent of our previous wireless network. For a laptop;, using the WiFi is functionally equivalent to an Ethernet connection on the internal LAN.

The next steps are to add two new SSIDs (wireless networks): one for Guests and one for wireless appliances (e.g., the kitchen oven, the TV sets, etc.). Those wireless networks must be blocked from seeing or knowing about the LAN, but should still be able to connect to the internet through the firewall. I assume that I must create two new DHCP servers for the two new networks. 

QUESTION:
-> How do I choose between "Separate Zone" AND "Bridge to VLAN"? 

There is a warning about MTU being reduced if Separate Zone is chosen. Otherwise, I am trying to understand the difference and the implication of choosing one over the other.

Please share your experience and advice regarding the best way to setup these Guest and Appliance wireless networks, isolated from the LAN. It will be most appreciated. 

P.S. The access points are connected to the UTM via unmanaged switches. Each access point is connected to a small unmanaged switch, to share the single Ethernet jack with other devices in the room. The Ethernet cables from the rooms all join together in my office closet at a larger unmanaged switch, which is connected to the LAN port on the UTM.



This thread was automatically locked due to age.
Parents
  • The question is still open:

    -> What is the best way to configure my wireless network to add two new separate SSIDs for guests and for home appliances to keep them isolated from the LAN, but still have access to the internet (through the firewall, of course)?

    ... and keep in mind that the Ethernet LAN communications between the access points and the UTM passes through unmanaged switches. 

    Separate Zone? Bridge to VLAN? Other ideas?

  • If using only unmanaged switches, you cannot go with the VLAN approach. So you are up to use sepearted zones. Lower MTU on the associated wlanX interface to 1450 bytes (as you can learn from here: https://oswalt.dev/2014/03/mtu-considerations-for-vxlan/ ot here: https://dave.dev/blog/2014/06/vxlan-mtu-vs-ip-mtu-consideration/ )

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • Danke, Herr Rusch!

    I am not going to manually change MTU settings on my guests' personal laptops, phones, and other devices, and there is no way to change them on the appliances like the oven and the TVs. 

    So, if I use Separate Zones, the devices on those isolated networks must either work with auto discovery or live with lesser performance from fragmentation (that's okay, if it works). Hopefully the third choice (dropped packets) won't happen, but we'll see.

    In the meantime, I will look at replacing my switches with smart ones that support VLANs. I will probably need it in the future anyway.

    Thanks to all for helping me understand my situation better.

  • Thanks!  I have a client in California with a speed problem and I suspected MTU..  This confirms the issue.  Their APX is behind a RED in a remote office, so I don't think I can do a VLAN.  Lowering MTU appears to be the solution.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Thanks!  I have a client in California with a speed problem and I suspected MTU..  This confirms the issue.  Their APX is behind a RED in a remote office, so I don't think I can do a VLAN.  Lowering MTU appears to be the solution.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data