Using MR86 with Verizon router - internet only access

[alceryes1]

Standard Verizon FiOS router, default settings.

2x MR86 connected to dumb PoE switch which is connected to the FiOS router.

We want the wireless networks on the MR86s to be guest/public only, with no access to the internal network that the FiOS router gives off. Can I just create a wireless that uses the Meraki DHCP for connected clients? Would wireless connected users have any way of accessing devices on the FiOS network?

TIA!

[PhilipDAth]

Use the "Deny Local LAN" option.

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_...

[alceryes1]

Got it.

So, set up the wireless using Meraki DHCP and then do 'deny local LAN access' and we should be good? No wireless clients should be able to access anything on the FiOS internel network?

[PhilipDAth]

It doesn't matter whether you use Meraki DHCP mode or not.  Clients wont be able to talk to anything on the local LAN.

[alceryes1]

Thanks.

I was just concerned since a lot of WAPs don't/can't do DHCP on their own. Looks like the MRs can.

[BrandonD · Accepted solution]

Hi @alceryes1,

Thats correct, we have a NAT Mode (Meraki DHCP) feature on our MR APs that will utilize the upstream MR AP's IP address and use a dynamic port for the downstream traffic.

Clients will get a randomized value in the 10.0.0.0/8 range based on a hash value of their MAC address - the below articles go more in depth on the specifics but in short the client isolation prevents any wireless clients from directly accessing anything on the LAN (defined as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 destined IP addresses.)

• https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP
• https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_...