How to allow guest network to access specific device on the main network by configuring EAP ACL?

How to allow guest network to access specific device on the main network by configuring EAP ACL?

How to allow guest network to access specific device on the main network by configuring EAP ACL?
How to allow guest network to access specific device on the main network by configuring EAP ACL?
2024-10-09 08:10:41 - last edited 2024-10-09 08:53:32

 

This Article Applies to:

 

All SDN EAPs.

 

Application Scenario:

 

 

As shown in the above topology, guests connecting to the guest network cannot access devices on the internal network, but guests are allowed to access the printer on the main network.

 

Configuration Steps:

 

Step 1. Create Guest SSID


Log in to the Controller management page, Choose Site view, Go to Settings> Wireless Networks > WLAN, and click Create New Wireless Network to create a guest SSID for the guests, as shown below:

 

 

 

Step 2. Configure DHCP Reservation for the Printer


Go to Settings>services> DHCP reservation and click Create New DHCP Reservation Entry, 

Or you can connect the Printer to the main network, go to the Client page, choose the printer, Config > Use Fixed IP Address, and input the IP address for the printer.

 

 


Step 3. Create an IP group for the Printer.

 

Go to Settings > Profiles > Groups > Create new IP group, Choose type as IP group, input the IP address for the Printer, and fill in the subnet as 32.

 

 

Step 4. Create an EAP ACL rule

Go to Settings > Network Security > ACL > EAP ACL> Create New Rule,  Choose the Policy as Permit, Select the Source as the Guest SSID's Network, select the Destination as the IP Group profile of the printer, as below:

 

Verification:

 

Guest clients can't access other WLAN clients:

Guests are able to access the printer:

Feedback:

 

  • If this was helpful, welcome to give us Kudos by clicking the upward triangle below.
  • If there is anything unclear in this solution post, please feel free to comment below.

 

Thank you in advance for your valuable feedback!

 

------------------------------------------------------------------------------------------------

Have other off-topic issues to report? 

Welcome to > Start a New Thread < and elaborate on the issue for assistance.

  2      
  2      
#1
Options
2 Reply
Re:How to allow guest network to access specific device on the main network by configuring EAP ACL?
a week ago - last edited a week ago

  @Vincent-TP Will this work across vlans?

 

Like if my printer is on a different VLAN? I'm having issues with guests not being able to airplay to devices on my main (different VLAN) network. I haven't troubleshooted it but I wonder if this would solve it. Or should this be done (in my case) at the gateway?

 

I have a gateway ACL that denies our Guest VLAN to all other VLANS, or is that redundant?

 

Edit: It works if I disable my gateway ACL for Guest VLAN to Main VLAN

  1  
  1  
#2
Options
Re:How to allow guest network to access specific device on the main network by configuring EAP ACL?
a week ago

 Hi @GoodOmens 

 

Happy to know it worked finally.

 

I have a gateway ACL that denies our Guest VLAN to all other VLANS, or is that redundant?

>>>Yes, no need to create this ACL rule for guest networks.

  0  
  0  
#3
Options