We did something close to that for guest access on our
network and at
remote sites. We have a mixture of ATM and Frame relay and
wanted
the ability to extend out unfettered internet access to our
remote
sites. What we used was a private vlan at the remote sites
which is
then connected via GRE to a vlan on a switch. The only exit
point is
an interface on a pix that is the default router and also
serves dhcp
for that vlan. We think we might use the same thing for
wireless
access at our remote sites.
On May 31, 2007, at 6:42 AM, Guyler, Rik wrote:
> I'm looking into turning on guest wireless access
across our
> campuses and
> looking into the various options for path isolation.
We have a
> single entry
> point to the Internet in our network so some type of
tunneling is
> what I
> have in mind but I'm not sure which method is the way
to go.
>
> I've considered plain GRE tunnels (no VRF) but that
would mean
> turning on
> PBR, which I really don't want to do. The switches
performing the
> PBR are
> 6500 w/Sup720 so plenty of horsepower but still, I
don't think it's
> the way
> to go. I've looked into MPLS through the campus and
believe it's a
> good way
> to go as is VRF-lite (non-BGP VRF) but I'm not sure if
they fit. I
> would
> only want to enable MPLS/VRF on the endpoints of the
tunnels and
> not the
> devices in between. I believe this will work but not
sure. I
> would also
> like to hear about any other possible path isolation
options if
> they exist.
>
> I would GREATLY appreciate it if somebody could
enlighten me on this
> subject. Any real-world experiences with campus guest
access to
> share?
>
> Thanks,
>
> Rik
> www.groupstudy.com/list/cisco.html
>
Joseph Jenkins
maillist breathe-underwater.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7
&i=121906&t=121906
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.
groupstudy.com/list/cisco.html
|
