Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

WAP4410N on a 3750G

Just setup a WAP4410N with two SSID's - one for guest and one for corporate side. Both are segregated by VLANs, however, I don't already have a guest VLAN defined, so I created one (VLAN 20).

However, this little WAP is hanging off a higher end Cisco 3750G switch, and it looks like I need to do a bit of config to actually ensure it provides proper Guest WiFi.

I was going to setup in the 3750G - DHCP Server for VLAN 20, DNS uses the ISP, point the gateway at the internal IP of the firewall.

But since the WAP4410N has one ethernet port, I am fitting the corporate and guest VLAN over the single switch port. Bad idea? I have found some config. to let both pass through, but then getting DHCP assigned to VLAN 20 on that port and passed properly to the firewall, I am not 100% sure of which direction is best to go (... looked at creating Private VLANs but seemed like a lot of work, thought it might be simpler).


Cisco Employee

Re: WAP4410N on a 3750G

Hi Edward, since you have two ssids and two vlans, you need to allow encapsulation dot1q trunk on the switchport and allow the two vlans on that interface.



New Member

Re: WAP4410N on a 3750G

Ok this is what I have for it, along with the DHCP Server in the switch, specifically for this guest VLAN:

ip dhcp excluded-address

ip dhcp excluded-address

interface GigabitEthernet1/8

description Cisco WAP4410N

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 20,100

switchport mode trunk

switchport nonegotiate

srr-queue bandwidth share 10 10 60 20

srr-queue bandwidth shape  10  0  0  0

queue-set 2

mls qos trust cos

macro description cisco-wireless

auto qos voip trust

spanning-tree bpduguard enable

ip dhcp pool vlan20



interface Vlan20

description Guest Wi-Fi

ip address

(and VLAN 100 is 192.168.1.x)

New Member

Re: WAP4410N on a 3750G


I did end up fixing DHCP assignments, however since the guest Wi-Fi is on VLAN 20, and only VLAN 100 and 200 are recognized by the edge router (which is managed by my ISP), the traffic would never go out to the internet.

Don't suppose I can NAT the traffic in the switch in any way, huh? Or some other solution to keep Guest WiFi from a WAP4410N isolated through a Cisco switch?

Cisco Employee

Re: WAP4410N on a 3750G

Hey Edward, as long as vlan 20 is allowed on that trunk port, why not to do just routing on the 3750 form that point and onwards?