VLAN & Routing help - SG300-28P

[ekhoo]

I've amended the previous network setup and now for the guest network, we're using a separate router/WAN link & provider.

I've attached the network diagram. Basically the WAP321 access points have two SSIDs, each mapped to VLAN 1 and 2 where 2 is for guests. Both routers also run DHCP.

If I connect to the guest network, I get a 192.168.24.x IP. Connecting to the internal network, I get a 192.168.101.x IP. On the 101 network, everything works. I can ping the gateway or router. On the guest network, I can get an IP address but I cannot ping the gateway or the switch (.24.254 and .24.222).

However, if I connect a cable to the LAN port of the router, I'm able to ping from the 24 network the switch as well as the router (24.222). I believe the problem has to do with the VLAN and routing on the SG300 but I can't seem to figure out how to solve this. Any ideas?

 

[stevech]

I've amended the previous network setup and now for the guest network, we're using a separate router/WAN link & provider.

I've attached the network diagram. Basically the WAP321 access points have two SSIDs, each mapped to VLAN 1 and 2 where 2 is for guests. Both routers also run DHCP.

If I connect to the guest network, I get a 192.168.24.x IP. Connecting to the internal network, I get a 192.168.101.x IP. On the 101 network, everything works. I can ping the gateway or router. On the guest network, I can get an IP address but I cannot ping the gateway or the switch (.24.254 and .24.222).

However, if I connect a cable to the LAN port of the router, I'm able to ping from the 24 network the switch as well as the router (24.222). I believe the problem has to do with the VLAN and routing on the SG300 but I can't seem to figure out how to solve this. Any ideas?

I suggest you use one subnet number, not two. Double-NAT with consumer gear has issues.
Increased coverage via more APs (not daisy chained routers) enables this.

 

[ekhoo]

Forgotten totally that I've enabled Captive portal on the WAP321s and they must authenticate the client before even allowing the pings to go through.

No double NAT here as the .24 network has it's own WAN router. It's just that we're using the same switch and access points.