Many thanks for your help.

When you use the ip redirect feature the access-point replaces the destination address so I don't understand how I can use it like a next-hop utility.

Andrea.

On the url in my previous post it states:

This feature is specifically applicable to a retail requirement for directing IP data traffic to a specific destination over a shared network. Some customers may be able to accomplish this using policy based routing in the routers. However, there are many instances where the store based routers are managed by service providers or are non Cisco devices. Further, it is not uncommon for a service provider to charge a customer as much as $100 per store location to provide policy based routing.

IP Redirect can also be used to auto redirect traffic to a gateway for guest authentication.

I;m not sure how to better explain it

On url in my first post:

An example of how this feature might be used is: establish next-hop routing; for example, pushing all guest traffic within an organization to the Internet router.

Regards,

Andrea.

Are you planning to separate the guest & user ssids into separate vlans/subnets?

Assuming that is the case, there needs to be a mechanism in the network to separate and/or route multiple subnets

guests------\

router---internet gw

internal-----/

internal svc/

The cheesy diagram above intends to show that that guests get internet access only, while internal get both internet and internal.

There are several ways to do this, but it really depends on your environment, # of users, how much control & access you have to internal client machines, etc.

For example, if the internet gw above can support vlan encapsulation or has a dmz interface as well as an internal interface, you could eliminate the middle router.

here is a small part of the ap config. You will also have to setup trunking on the switch port as well

guest net 192.168.3.0

internal net 192.168.2.0

dmz net 192.168.1.0

access-list 10 permit 192.168.3.0

! anything else hits the implicit deny

#ssid guest_SSID

! name of ssid for guests

ip redirection host 192.168.1.1

! ip address of internet gateway

access-group 10 in

! force traffic from guest ssid to be redirected

There are several options, many of which can be configured on the wired side

Hello Eric and many many thanks for your help.

I understand what you are saying but when I try to redirect to a host (on the same subnet) the access-point replaces the destination ip address and the connection ends at the redirected ip.

Andrea.

I'm not sure if the redirect command will do that, I've never tried using a redirect to send to an ip on the same subnet. In the example from the url in the earlier post, it shows a redirect to a host in a different subnet. What is the redirected ip address you mention? is it on the same subnet?