Hi everyone,
I just got some Ubiuiti UniFi Pro APs for work, so far I love them, definitely leaps and bounds ahead of the two Linksys home routers we had previously, which brings me to the question at hand. I'm going to restructure our setup so the Guest network is on another VLAN with a different SSID rather than the previous setup where we just used one AP for internal and one for guest with the guest setup as a standard home router using one of our external IPs. One reason I want to get the Guest network on a VLAN is so I can provide vendors, auditors, and whoever else we may have on-site with access to printers, which has always been problematic in the past. Since the APs won't provide DHCP addresses to guest clients, my thought on a solution was to add a VM to our vSphere environment that has one virtual NIC in a port group for the guest vlan and another on the internal, block all non-necessary ports on both NICs (with a software fw), and use that for DHCP & Print Server.
I'm concerned about what type of security risks I'd be opening up to there, and whether there are any better solutions, unfortunately purchasing printers specifically for the guest network isn't really an option because we've got a 150,000 sq ft plant and there are a number of locations that would need to have readily accessible printers, I'd really like to avoid any changes to the current printer setup too(for now anyway) because our ERP software prints to them based on IP over our corporate WAN, and most of our clients have them installed using the IPs as local ports.
So I guess my questions are is how secure would a setup as described be? Is there a better solution? And what do you Spice Heads use?
Thanks in advance!