Guest wireless with VLAN Tagging

[CMorinski]

Trying to setup a guest ssid in my elementary school. Below is how the ISP has our firewall configured. 

0/3                         1x.2xx.2xx.1/22                Internal Wireless             VLAN 35 Tagged

0/3.1007                1x.2xx.9x.0/23                   Guest Wireless                  VLAN 1007 Tagged

I am new to this process and would like to figure it out instead of contacting my vendor to set it up.  

I assumed I would use NAT Mode but how do I configure firewall settings to pull from my IP pool setup by the ISP instead of this one? (10.0.0.0/8)

NAT mode: Use Meraki DHCP

Clients receive IP addresses in an isolated 10.0.0.0/8 network. Clients cannot communicate with each other, but they may communicate with devices on the wired LAN if the SSID firewall settings permit.

[ww]

In nat mode its always using meraki dhcp.

I would recommend reading this

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignme...

Use bridge mode and tag it with vlan 1007.

Configure the firewall to deny  local lan and enable l2 lan isolation

[CMorinski]

Thanks!  I did try doing it that way yesterday.  When i try connecting to the guest it will eventually time out just give me a 169.254.x.x IP.

[ww]

Do you have trunk ports between the firewall and the switches and to the AP?

Are you sure there is a dhcp scope for this subnet?

[CMorinski]

My AP's to the switch are set as trunk ports.  My port from switch to firewall is Access.  I did submit a ticket to my ISP to double check the firewall is correct.

[ww]

That sounds like the problem. A access port transport only 1 vlan(native).   If you want to use more vlans from the firewall you should have trunk ports transporting those vlans

[CMorinski]

I really appreciate the help on this!  So would my native vlan need to be 35 and allowed just need to be 1007??

[ww · Accepted solution]

Yes , but maybe first configure it on a empty switch port and swap the cable to that port.  In case it doesnt work you can easily go back.

[CMorinski]

Almost had it.  I was able to get the correct IP address but I had no internet.  I got no internet on both my secure or guest ssid.  Could the trunk port for the AP cause issues?  They are not set for vlan 35

[ww]

That looks fine.  Maybe vlan 35 is also tagged and native should be 1 on the uplink?, but your previous config shows access port vlan 35, thats confusing.

What management IP/subnet does you AP have?

[CMorinski]

VLAN 1 is for my wired devices.  My AP's are pulling their IP from the wired DHCP pool. 

0/1                         10.236.68.1/22                   Data

0/3                         10.236.236.1/22                Internal Wireless               VLAN 35 Tagged

0/3.1007               10.236.94.0/23                   Guest Wireless                  VLAN 1007 Tagged

0/4                         10.236.5.1/24                     VOIP

0/5                         10.236.81.1/24                   DMZ                                      (Not being used yet)

0/6                         10.236.32.1/24                   Bell & Intercom

0/7                         Uplink

[alemabrahao]

I think a good test might be to configure a port in access mode on each VLAN and test the connection with a laptop to validate that the connection to each VLAN is working as expected.