Need some guidance on wireless setup

Hi there!  So yeah, for you I'd say for your WiFi networks:

Company_WiFi: Bridge to AP LAN

Guest_WiFi: Separate Zone

You'll have to create the Zone first in Network\Zones.  You could use the existing WiFi zone for guests, since your Company_WiFi will be in the LAN zone (with the bridge to AP LAN).  You can also assign ports or VLANs on the XG to those zones (in Network\Interfaces).  So you could make the Guest_WiFi it's own VLAN AND Zone.  And connect up some ports on a switch with that specific VLAN and give it its own DHCP service(s) and make the ports in your conference room go to the Guest VLAN + Zone.  Zones let you build better Firewall rules, IMO.  VLANs are still good for extra protection to make it more difficult for systems to hop zones by their IP definition.

Does this help?

This was very helpful and I really appreciate it, thanks.

If I may ask a follow up question in regards to using a Zone for the guest APs; the AP's will be broadcasting the same SSID (Guest_WiFi for example) in multiple different physical locations on different subnets.  In the Wireless Network setup I see that I have to assign it an IP address and this creates a network interface.  How does this traffic get back to the XG across a routed network; is it tunneled across the network?  If its not, I'm going to need some way to assign different subnets to the different AP's so the traffic gets routed correctly across my network.  

Bill,

please provide a network diagram so we can better understand your needs.

Thanks

Bill,

please provide a network diagram so we can better understand your needs.

Thanks

Hi Luk, yeah, I should have included a diagram.  Here is a crude diagram showing what I've got.  The idea is for each of the sites to have Sophos AP's, and within each site, I'd like an SSID that bridges to the AP LAN for "company" traffic and a guest SSID that is on VLAN 2 for guest low priority traffic and to keep the guest traffic segmented from my company LAN.

How are the connections made between branch offices to the HQ?  You may want to investigate using Sophos Cloud control for the WiFi Access Points.  I'd be hard pressed to make this work if the private WAN links shown here aren't managed by Sophos XG firewalls.  It's not designed to be able to manage WiFi access points that aren't local.  It -CAN- but the private WAN links need to pass all the appropriate traffic.  Sophos RED devices make that rather simple, but I'm not sure it would be simple here.

Also, you don't need separate WiFi Access Points for Guests vs Corporate, you just need to define multiple SSIDs per access point.

How are the connections made between branch offices to the HQ?  You may want to investigate using Sophos Cloud control for the WiFi Access Points.  I'd be hard pressed to make this work if the private WAN links shown here aren't managed by Sophos XG firewalls.  It's not designed to be able to manage WiFi access points that aren't local.  It -CAN- but the private WAN links need to pass all the appropriate traffic.  Sophos RED devices make that rather simple, but I'm not sure it would be simple here.

Also, you don't need separate WiFi Access Points for Guests vs Corporate, you just need to define multiple SSIDs per access point.

All the sites in question are connected via Metro-Ethernet circuits with Adtran routers at each end.    

Right, I'm just using a single AP for different SSID's (SSID for guest, SSID for corp).  

So looking back at the diagram, you'd need to do some IP scheme changes to make it work, if the AddTran devices are passing the correct traffic (may need to talk to your provider).  Through your provider, could you make all VLAN2 networks across all sites use the same subnet, maybe a /23 or /22?

Bill,

thanks for the info. Who is performing the DHCP on remote sites?

How do you manage the magic ip (1.2.3.4) from remote site to UTM?

Thanks

I'm really interested to see how this could work.  In my mind, the easiest path would be the Sophos Cloud controller for WiFi on this one.  That retails for about $100/WAP/yr

Chris,

this depends on how the remote sites forward the 1.2.3.4 ip to XG at HQ. Once the AP starts, it grabs an IP address from the DHCP server within the broadcast domains and then try to reach XG 1.2.3.4 IP to register it and receive the proper IP. So each AP can bridge to AP LAN or VLAN if a dhcp server exists at each location or if a layer 3 device sends the 1.2.3.4 to XG at HQ.

Gentlemen, thank you for the additional discussion and sharing your knowledge.  

The idea is/was to setup a DHCP Relay agent on the Adtran's to relay DHCP requests to a Windows DHCP server.  Having said that, I can also create a DHCP server on the AdTran routers themselves and it appears I can set different DHCP relay destinations per VLAN, so I could set the DHCP Relay option on the WiFi VLAN to forward to the XG.