Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

This article explains how to create a Guest VLAN in the TZ firewall, for guest users to access Internet only. Guest users will not be able to access any other Local network.

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

Create a zone for guest VLAN.

1. Navigate to Object| Match objects| Zone.
2. Add Zone|Name the Zone| Security type: Public.

 NOTE: Do not enable any of the auto-generate rules for guest VLAN, that way we can add the specific firewall rule only for internet access. If communication is needed to any other network we need to create access rules accordingly for them.

Create a Virtual interface.

1. Navigate to Network| System| Interface.
2. Add Virtual interface|Select the Guest VLAN zone previously created.
3. Add a VLAN tag, provide static IP and subnet mask and enable ping.
   

Enable DHCP scope for newly configured VLAN Interface.

1. Navigate to Network| System| DHCP server.
2. Add Dynamic Scope|Enable Interface Pre-popolate| Select X0:V10
3. Go to DNS tab| Add DNS server.
   

Configure Guest VLAN zone to WAN zone access rule.

1. Navigate to Policy| Rules and policies.
2. Select Guest VLAN to WAN.
3. Add rule|Configure as shown in the image(Default config)| Save.

• With the above config Devices connected to this GUEST VLAN zone will be able to access internet and communicate within Guest VLAN devices but cannot communicate with any other local devices.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Create a zone for guest VLAN.

1. Navigate to Manage| Interface| Zone.
2. Add Zone| Name the Zone| Security type: Public.

 NOTE: Do not enable any of the auto-generate rules for guest VLAN, that way we can add the specific firewall rule only for internet access. If communication is needed to any other network we need to create access rules accordingly for them.

Create a Virtual interface.

1. Navigate to Manage| Network| Interface.
2. Add Virtual interface| Select the Guest VLAN zone previously created.
3. Add a VLAN tag, provide static IP and subnet mask and enable ping.
   

Enable DHCP scope for newly configured VLAN Interface.

1. Navigate to Manage| Network| DHCP server.
2. Add Dynamic Scope| Enable Interface Pre-popolate| Select X0:V10
3. Go to DNS tab| Add DNS server.
   

Configure Guest VLAN zone to WAN zone access rule.

1. Navigate to Rules| Access rules.
2. Select Guest VLAN zone to WAN zone.
3. Add rule| Configure as shown in the image(Default config)| Save.
   

• With the above config Devices connected to this GUEST VLAN zone will be able to access internet and communicate within Guest VLAN devices but cannot communicate with any other local devices.