A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.
A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.
Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit