@PhilipDAth wrote:
I'm not aware of tools for scanning guest networks. How about a simple nmap scan to confirm the firewall is only allowing what is intended?
In my experience, it is also important to ensure that Guests are isolated from each other. Which might not be the case with staff users, so probably better to set up separate SSIDs/VLANs and to use SM to look after the staff's BYODs.
Experience also leads me to suggest that if guest network users are given access to a printer, then that printer should be in a restricted area, as there can be problems if Guest A's printing is picked up by Guest B, if they have to ask a receptionist for their printing, there are less likely to be problems, and free-riders can be dealt with immediately.