-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.
11/30/2023 
22 People found this article helpful
288,689 Views
Description
This article explains how to create a Guest VLAN in the TZ firewall, for guest users to access Internet only. Guest users will not be able to access any other Local network.
Resolution
Resolution for SonicOS 7.X
This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.
Create a zone for guest VLAN.
- Navigate to Object| Match objects| Zone.
- Add Zone|Name the Zone| Security type: Public.
NOTE: Do not enable any of the auto-generate rules for guest VLAN, that way we can add the specific firewall rule only for internet access. If communication is needed to any other network we need to create access rules accordingly for them.
Create a Virtual interface.
- Navigate to Network| System| Interface.
- Add Virtual interface|Select the Guest VLAN zone previously created.
- Add a VLAN tag, provide static IP and subnet mask and enable ping.
Enable DHCP scope for newly configured VLAN Interface.
- Navigate to Network| System| DHCP server.
- Add Dynamic Scope|Enable Interface Pre-popolate| Select X0:V10
- Go to DNS tab| Add DNS server.
Configure Guest VLAN zone to WAN zone access rule.
- Navigate to Policy| Rules and policies.
- Select Guest VLAN to WAN.
- Add rule|Configure as shown in the image(Default config)| Save.
- With the above config Devices connected to this GUEST VLAN zone will be able to access internet and communicate within Guest VLAN devices but cannot communicate with any other local devices.
Resolution for SonicOS 6.5
This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.
Create a zone for guest VLAN.
- Navigate to Manage| Interface| Zone.
- Add Zone| Name the Zone| Security type: Public.
NOTE: Do not enable any of the auto-generate rules for guest VLAN, that way we can add the specific firewall rule only for internet access. If communication is needed to any other network we need to create access rules accordingly for them.
Create a Virtual interface.
- Navigate to Manage| Network| Interface.
- Add Virtual interface| Select the Guest VLAN zone previously created.
- Add a VLAN tag, provide static IP and subnet mask and enable ping.
Enable DHCP scope for newly configured VLAN Interface.
- Navigate to Manage| Network| DHCP server.
- Add Dynamic Scope| Enable Interface Pre-popolate| Select X0:V10
- Go to DNS tab| Add DNS server.
Configure Guest VLAN zone to WAN zone access rule.
- Navigate to Rules| Access rules.
- Select Guest VLAN zone to WAN zone.
- Add rule| Configure as shown in the image(Default config)| Save.
- With the above config Devices connected to this GUEST VLAN zone will be able to access internet and communicate within Guest VLAN devices but cannot communicate with any other local devices.
Related Articles
- How to Block Google QUIC Protocol on SonicOSX 7.0?
- How to block certain Keywords on SonicOSX 7.0?
- How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
YES
NO