Novice needing network design advice

[denniston]

We are wanting to add guest wireless to our network at our church, but I'm not sure how to keep the guests off the secured network.

Our building is roughly 300' long. Our internet comes in on the East end of the building, and our main meeting space is on the West end.

My goal is to provide both guest & staff wireless coverage to the entire building. Becuase I really don't have a budget for this project, I'd like to stick with consumer grade devices (i.e. no managed switches, but I've seen them used fairly reasonable). I'm not afraid to flash to DD-WRT to get more functionality.

I guess my main question is, can I set up an access points with both guest and staff access. If so, can someone please point me in the right direction.

I was looking at these: http://amzn.com/B004UBU8IE
But I haven't really kept up with the devices, and don't know what is good.

Thanks in advance for your help.

Oh yeah, I created a couple of network diagrams to explain what we have and what we'd like.
Here's what we have:

Here's what I think we would like:

 

[abailey]

Your diagrams aren't showing up. Do you currently have wifi for the staff and just want to add wifi for guest, or do you currently have no wifi? Will your access points have a wired connection to your network?

 

[coxhaus]

Multiple wireless SSIDs and VLANs kind of go hand and hand especially with multiple APs all running on the same cable. If you could restrict your staff to wired only or segmented off then you can use any old wireless devices and you could segment your network with an extra router. Otherwise you need to build separate networks with separate cable.

 

[L&LD]

With a few Asus (RT-AC56U or higher running RMerlin firmware or the john9527 or hggomes forks) routers used in Router mode and using only the Guest networks with AP isolation On and the main WiFi ssid's not used at all (create complex passwords that nobody knows or uses), this is a simple thing to do.

But when you switch to AP mode, you will lose the Guest network functionality (that is why it must be in Router mode).

Simply connect a LAN cable to the WAN port of the router and setup the guest ssid's as you see fit for both the 2.4GHz and the 5GHz bands.

 

[abailey]

You can also use any of the Ubiquiti Unifi AP's. They have a built in isolation mode for guest that works without having to have VLANs.

 

[coxhaus]

You can also use any of the Ubiquiti Unifi AP's. They have a built in isolation mode for guest that works without having to have VLANs.

I wonder how these work technically? How do they keep the guess traffic isolated all the way out the router from multiple APs?
Are the guess clients located in the same network?

 

[abailey]

I wonder how these work technically? How do they keep the guess traffic isolated all the way out the router from multiple APs?
Are the guess clients located in the same network?

Yes same network but they use filters. You can block IP ranges, like all private IP ranges so it can only see the internet. Though even if you block all private IP addresses it can still pull DHCP and it can still see the default gateway. But if you try to pull up the admin page for the default gateway it can not do that. So I assume it also does port filtering. See below:

 

[coxhaus]

This makes sense as the wireless device is doing the filtering and only allowing access to certain IPs. How does a user get assigned to a guest network. Is it by logon or MAC? I assume it is automatic once setup.

 

[denniston]

Your diagrams aren't showing up. Do you currently have wifi for the staff and just want to add wifi for guest, or do you currently have no wifi? Will your access points have a wired connection to your network?

I'm not sure why the diagrams are not showing up. They show for me.
Yes, we currently have wifi access.
The access points will be wired. My understanding is that wireless repeaters cut the bandwidth in half. Is that true?

 

[L&LD]

My understanding is that wireless repeaters cut the bandwidth in half. Is that true?

Yes. And when that repeater is in use, it will deteriorate not only the WiFi for that network for all devices, but for all other routers too that are either on the same channel or using an overlapping channel (or two, in the 2.4GHz band).

 

[denniston]

Multiple wireless SSIDs and VLANs kind of go hand and hand especially with multiple APs all running on the same cable. If you could restrict your staff to wired only or segmented off then you can use any old wireless devices and you could segment your network with an extra router. Otherwise you need to build separate networks with separate cable.

Unfortunately several of our computers will need to both be wireless and have access to resources on the secure portion of the network.

My desire is to not have to have a separate device for each ssid (not to mention, i'm no sure how easily we can pull a per cable to he west end of the building). Are you suggesting hat I should get a managed switch? If so, would something like a Dell PowerConnect 2724 be a serviceable choice?

 

[abailey]

This makes sense as the wireless device is doing the filtering and only allowing access to certain IPs. How does a user get assigned to a guest network. Is it by logon or MAC? I assume it is automatic once setup.

It is by SSID. When you set up an SSID you have to tell the software whether it is a guest SSID or not. Not sure what would happen if you tried to make the Guest SSID the same as the internal network SSID.

 

[abailey]

Unfortunately several of our computers will need to both be wireless and have access to resources on the secure portion of the network.

My desire is to not have to have a separate device for each ssid (not to mention, i'm no sure how easily we can pull a per cable to he west end of the building). Are you suggesting hat I should get a managed switch? If so, would something like a Dell PowerConnect 2724 be a serviceable choice?

A managed switch will work as long as you get AP's that support multiple VLAN's (and a router that supports multiple VLANs). You could also get the Ubiquiti Unifi AP's I mentioned. They don't have to have a managed switch and VLANs to segregate guest from internal staff, but they can work with multiple VLANs if you wish. The standard 2.4ghz Unify AP's are about $65 each.

 

[coxhaus]

It is by SSID. When you set up an SSID you have to tell the software whether it is a guest SSID or not. Not sure what would happen if you tried to make the Guest SSID the same as the internal network SSID.

This makes total sense to me now. Thanks

 

[coxhaus]

Unfortunately several of our computers will need to both be wireless and have access to resources on the secure portion of the network.

My desire is to not have to have a separate device for each ssid (not to mention, i'm no sure how easily we can pull a per cable to he west end of the building). Are you suggesting hat I should get a managed switch? If so, would something like a Dell PowerConnect 2724 be a serviceable choice?

If you are going to have wireless for both staff and guess and share resources you are going to want to use a separate VLAN for each. To share resources across VLANs it is best done at layer 3 with ACLs.

 

[denniston]

Thanks for your reply & bearing with my lack of knowledge:

If you are going to have wireless for both staff and guess and share resources

by resources do you mean physical devices? As far as resources the guests will only be accessing the internet.

you are going to want to use a separate VLAN for each. To share resources across VLANs it is best done at layer 3 with ACLs.

to clarify, that means installing a managed switch, correct?

If so, would the Dell PowerConnect 2724, be an ok choice? It seems to be quite reasonable used.

Thanks again,

Jason

 

[coxhaus]

If your guess are only going to access the internet then I would use what abailey recommended and use the standard 2.4ghz Unify AP' since they are only $65. It sounds cheap to me. You don't need a managed switch just CAT5e cable out as far as you need to cover both ends of the church.

PS
You probably will need more ports. It will be based on how many wireless units you install. An 8 port switch does not go very far. I don't know how many free ports you have. I confused your post with another one.

PSS
Maybe Dell switches are better now but I had an old one that would require a reboot every 6 months or so. The switch would slow down until you could not stand it and you rebooted it. I finally gave it away a couple of years ago. It was a 16 port switch.

 

[denniston]

So I think I fell into a deal today.
I picked up 2 HP J4813A ProCurve 2524 10/100 24 Port Managed Switches for $17 each.
What?

 

[sfx2000]

I picked up 2 HP J4813A ProCurve 2524 10/100 24 Port Managed Switches for $17 each

Maybe, maybe not - can pick them up on Amazon for 15 bucks each...

They've been end-of-sale since 2009...

http://h17007.www1.hp.com/docs/products/eos/2300-2500_Series_ES_Announcement_Sep_09_WW_eng.pdf

Decent switches, might have some challenges with firmware and management tools...

 

[denniston]

Maybe, maybe not - can pick them up on Amazon for 15 bucks each...

They've been end-of-sale since 2009...

http://h17007.www1.hp.com/docs/products/eos/2300-2500_Series_ES_Announcement_Sep_09_WW_eng.pdf

Decent switches, might have some challenges with firmware and management tools...

So much for that. But, I still think we will be able to get down the road with this.