Campus lan and Wireless lan solution Design Guide

Centralized deployments with guest wireless 
For centralized (local-mode) deployments, the traditional method of providing wireless guest access is to 
implement a dedicated guest anchor controller in an Internet DMZ segment. The internet edge / DMZ firewall 
restricts access from the guest network (specific ports on the firewall need to be opened for the tunneled data 
connection). The guest network is only able to reach the Internet and the internal DHCP and DNS servers (unless 
separate DHCP and DNS servers are deployed within the DMZ for further isolation). 
 
Traditional guest wireless anchor controller design 
Figure 38. 
Additional security functionality besides firewalling may be applied within the Internet Edge / DMZ. This additional 
functionality is not shown in the figure above. 
Cisco Catalyst 9800 Series wireless controllers support secure mobility – meaning the anchor tunnel uses 
CAPWAP encapsulation, as opposed to Ethernet-over-IP (EoIP). CAPWAP control traffic is encrypted, with the 
additional option of encrypting the CAPWAP data traffic between the foreign and anchor wireless controllers. 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 52 of 76
Cisco FlexConnect guest deployments 
For Cisco FlexConnect guest deployments, the guest WLAN/SSID can be centrally switched and anchored 
through a dedicated guest controller in an Internet DMZ segment. 
 
FlexConnect with centrally-switched guest wireless access 
Figure 39. 
Alternatively, the guest WLAN/SSID can be locally switched to a VLAN within the branch which provides direct 
Internet access (DIA). 
 
FlexConnect with locally-switched guest wireless access 
Figure 40. 
Additional security functionality besides firewalling may be applied within the branch for direct Internet access. This is not 
shown in the figure above.