Hot!The best practice to separate guest network from internal LAN

Author
CodeTron
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/04/04 01:54:33
  • Status: offline
2018/02/13 05:51:17 (permalink)
0

The best practice to separate guest network from internal LAN

What is the best way to separate a guest network from internal LAN to feed a guest WiFi AP?
I'm currently using a FG 90E box and dedicating a physical port (not part of a switch group) and put it in a zone with the option "Block intra-zone traffic" checked with a policy to allow traffic from this port to WAN
Or should I use a Vlan?
 
Thanks
 
  
post edited by SamH - 2018/02/13 05:52:57
#1

4 Replies Related Threads

    dmcquade
    Bronze Member
    • Total Posts : 57
    • Scores: 2
    • Reward points: 0
    • Joined: 2016/10/31 06:21:51
    • Status: offline
    Re: The best practice to separate guest network from internal LAN 2018/02/13 17:38:22 (permalink)
    0
    Assuming your internal LAN is wireless and you are sharing the same physical interface, create VLANs on the interface. Have the VLAN IP address be the routing address for each subnet. Have the wireless AP / Controller tag the traffic for each SSID matching the VLAN numbering on your Fortigate. This will give you the flexibility to create different access policies and security profiles. As long as you don't create a rule that allows one VLAN to access the other, you have separation.
     
    HTH
    d
    #2
    CodeTron
    New Member
    • Total Posts : 13
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/04/04 01:54:33
    • Status: offline
    Re: The best practice to separate guest network from internal LAN 2018/02/13 23:51:46 (permalink)
    0
    Since my guest network is attached to a physical port that is not part of the internal LAN and have it in a zone that doesn't allow internal traffic and has a policy to allow traffic to WAN only. is this sufficient or I should be using a Vlan on one of the ports instead?
     
    #3
    ede_pfau
    Expert Member
    • Total Posts : 5701
    • Scores: 385
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: The best practice to separate guest network from internal LAN 2018/02/14 08:11:00 (permalink)
    0
    So what do you need a zone for then? WiFi guest traffic already is seperated from (wired) LAN, that's it. I call that a DMZ...
    The zone construct combines several ports (physical, WiFi, VLAN, VPN) into one logical interface, either to reduce the number of policies, to provide failover or to enable intra-zone traffic without policies ("security switch"). I can't really recognize any of this in your requirements.
     
    If you plan to radio an internal SSID over the same AP then apply the 2-VLAN-recipe from @dmcquade. That's the best it can get.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #4
    CodeTron
    New Member
    • Total Posts : 13
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/04/04 01:54:33
    • Status: offline
    Re: The best practice to separate guest network from internal LAN 2018/02/14 09:57:07 (permalink)
    0
    Thanks
    #5
    Jump to:
    © 2018 APG vNext Commercial Version 5.5