Ok, So here is another question.

I have several 831's that we cannot replace unless they die, due to budget constraints. What we are doing in the meantime is to add a wireless router to the equation. The bottom line we want to achieve is to keep the two networks totally seperate. Wireless router has a WAN IP set up as 10.10.10.x and the LAN for wireless users is 192.168.0.x

As of right now, wireless users can browse my 10.x network and access the shares, which we want to avoid using VLAN's. Is there any other way we can achieve this solution?

Thanks

I am confused about your setup. Are all your 10.10.10.x devices connected directly to the router or are you using a switch?

If you are using a switch, does it support VLANS and 802.1q trunking.

Yes all the 10.10.10.x devices are connected directly to the router (usually 1-3 PC's and 1 Wireless router). There are a couple exception to this where we have more than 4 devices and we use a small 5-10 port switch to overcome the issue.

You can use ACLS' to block the access from one segment to another.

-amit singh

I am not sure how I can block using ACLS' so I am posting parts of the configuration that we have currently on the routers.

E1 - Static Public IP address

E0 - LAN IP - 10.10.10.x range

Access list associated with E0

access-list 100 permit tcp 10.10.10.0 0.0.0.7 host 10.10.10.1 eq 22

access-list 100 permit tcp 10.10.10.0 0.0.0.7 host 10.10.10.1 eq 443

access-list 100 permit tcp 10.10.10.0 0.0.0.7 host 10.10.10.1 eq cmd

access-list 100 deny tcp any host 10.10.10.1 eq telnet

access-list 100 deny tcp any host 10.10.10.1 eq 22

access-list 100 deny tcp any host 10.10.10.1 eq www

access-list 100 deny tcp any host 10.10.10.1 eq 443

access-list 100 deny tcp any host 10.10.10.1 eq cmd

access-list 100 deny udp any host 10.10.10.1 eq snmp

access-list 100 deny ip host 255.255.255.255 any

access-list 100 deny ip 127.0.0.0

For the sake of this example if my wireless router has ip address 10.10.10.5 should I add this to the access list to make this work? Would doing this stop it from going out on the internet? (Internet --- [static IP] Cisco 831 [IPs 10.10.10.x range] --- [10.10.10.5 IP] Wireless Router [192.168.0.x range] --- Wireless Clients)

All internet traffic goes out through the cisco 831.

access-list 100 deny tcp 10.10.10.5 10.10.10.0 0.0.0.7 eq any

Thanks again!