> Да сделай отдельную сеть SSID в отдельном DMZ VLAN для гостей с
> WPA-PSK.
> Карточки с паролем на ресепшене выдавать.ну опять же все упирается в точку доступа которая должна вещать 2 ssid с разными vlan. у меня пока с этим затруднения, DHCP в них почему то не отдается.
вот конфиг точки
ap#sh run
Building configuration...
Current configuration : 3146 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
enable secret 5 xxxxxxxxxxxxxxxxxx
!
led display alternate
ip subnet-zero
!
!
no aaa new-model
dot11 mbssid
dot11 vlan-name AIR vlan 1
dot11 vlan-name GUEST vlan 102
!
dot11 ssid AIR
vlan 1
authentication open
authentication key-management wpa
mbssid guest-mode
wpa-psk ascii 7 xxxxxxxxxxx
!
dot11 ssid GUEST
vlan 102
authentication open
authentication key-management wpa
mbssid guest-mode
wpa-psk ascii 7 xxxxxxxxx
!
power inline negotiation prestandard source
!
!
username admin password 7 xxxxxxxx
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 102 mode ciphers tkip
!
encryption vlan 1 mode ciphers tkip
!
ssid AIR
!
ssid GUEST
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
ip address 192.168.1.246 255.255.255.0
no ip unreachables
no ip proxy-arp
no ip route-cache
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.102
encapsulation dot1Q 102
ip address 192.168.2.100 255.255.255.0
no ip route-cache
no cdp enable
bridge-group 102
bridge-group 102 subscriber-loop-control
bridge-group 102 block-unknown-source
no bridge-group 102 source-learning
no bridge-group 102 unicast-flooding
bridge-group 102 spanning-disabled
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
no dfs band block
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
channel dfs
station-role root access-point
world-mode legacy
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
hold-queue 160 in
!
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0.102
encapsulation dot1Q 102
no ip route-cache
bridge-group 102
bridge-group 102 subscriber-loop-control
bridge-group 102 block-unknown-source
no bridge-group 102 source-learning
no bridge-group 102 unicast-flooding
bridge-group 102 spanning-disabled
!
interface BVI1
ip address 192.168.1.247 255.255.255.0
no ip route-cache
!
ip default-gateway 192.168.1.251
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
login local
!
end
vlan 1 b vlan 102 подняты на главном маршрутизаторе. в 102 раздает циска DHCP а в vlan1 - DC.
а вот порт коммутатора просто в транк, так как распилить интерфейс не получается изза отсутсвия адекватной команднеой строки...
