Guest Wi-Fi that actually associates

What you'll build

• Edge — a router, the gateway for the guest subnet
• SW-Lobby — a switch, the lobby switch everything hangs off
• AP-Lobby — a ap, the access point bridging Wi-Fi onto the LAN
• Desk-PC — a pc, a wired host on the guest subnet
• Laptop-Guest — a pc, the visitor's laptop, wireless only

Step by step

1. 1. Lay down the wired core

   Start with the wired side, because the radio has to land somewhere. Give the router's LAN leg the address that every guest device, wired or wireless, will use as its gateway, and hang a switch off it to fan the subnet out.

   • Cable Edge Gi0/0 ↔ SW-Lobby Gi0/1

   On Edge — Name the router and address the guest LAN leg

   enable
   configure terminal
   hostname Edge
   interface Gi0/0
   description GUEST-LAN
   ip address 192.168.10.1 255.255.255.0
   no shutdown
   exit
   end

   On SW-Lobby — Name the switch and put the uplink in the guest VLAN

   enable
   configure terminal
   hostname SW-Lobby
   interface Gi0/1
   switchport mode access
   switchport access vlan 1
   no shutdown
   exit
   end

   Check: run show ip interface brief on Edge and look for Gi0/0 192.168.10.1 YES manual up.

   Why: Wi-Fi is an access method, not a separate network: an access point bridges wireless clients onto a wired VLAN, where they share that VLAN's subnet and gateway with everything cabled into it. Designing the subnet and its gateway first is designing the guest network; the radio only decides how guests attach.

2. 2. Prove the wired half before any radio

   Wireless faults are hard to read when the wired path underneath them is still unproven. Address a desk machine on the same subnet and ping the gateway now, so that when the laptop goes quiet later you already know the cabling, the addressing and the gateway are sound.

   • Cable SW-Lobby Fa0/2 ↔ Desk-PC Eth0

   On Desk-PC — Name the desk machine and give it a static address on the guest subnet

   hostname Desk-PC
   ipconfig Eth0 192.168.10.30 255.255.255.0 192.168.10.1

   Check: run ipconfig /all on Desk-PC and look for IPv4 Address. . . . . . . . . . : 192.168.10.30.

   Why: This is bottom-up troubleshooting applied before anything breaks: prove layer 1, then layer 2, then layer 3, and only then add the next variable. Wireless adds a layer-2 step of its own — association — and that step is far easier to judge on its own than tangled up with a cabling or addressing fault.

3. 3. Bridge the access point in and define the guest SSID

   An access point is a transparent bridge: it holds no IP of its own and simply carries frames between its wired port and its radio, which is why guests end up on the same subnet as the desk machine. Cable it into the switch, then define the guest network as a profile — the name visitors look for, WPA2 key management, and the passphrase they type.

   • Cable SW-Lobby Fa0/1 ↔ AP-Lobby GigabitEthernet0

   On SW-Lobby — Put the AP's wired port in the guest VLAN

   enable
   configure terminal
   interface Fa0/1
   switchport mode access
   switchport access vlan 1
   no shutdown
   exit
   end

   On AP-Lobby — Name the AP, bring its wired leg up, and define the WPA2-PSK guest SSID

   enable
   configure terminal
   hostname AP-Lobby
   interface GigabitEthernet0
   no shutdown
   exit
   dot11 ssid GUEST-WIFI
   authentication key-management wpa version 2
   wpa-psk ascii LobbyGuest2026
   guest-mode
   exit
   end

   Check: run show dot11 ssid on AP-Lobby and look for GUEST-WIFI WPA2-PSK (key set) broadcast unbound.

   Why: An SSID profile is only a definition: the network name clients look for and how they must prove they belong. With WPA2-PSK every guest proves knowledge of one shared passphrase, and the keys that encrypt each guest's traffic are derived from it during the join, so the passphrase itself never crosses the air.

4. 4. Configure the visitor's laptop

   Drop the laptop in range and wire its Wireless0 NIC to the AP radio. Address Wireless0 and nothing else: a PC sends from the first interface that is up and addressed, Eth0 sorts first, and an address there would push guest traffic down a cable this laptop does not have. The join line is accepted the moment you type it, yet the laptop still cannot reach the gateway, because no radio is advertising GUEST-WIFI yet.

   • Cable AP-Lobby Dot11Radio0 ↔ Laptop-Guest Wireless0 (wireless)

   On Laptop-Guest — Address the Wi-Fi NIC, then ask it to join GUEST-WIFI with the passphrase

   hostname Laptop-Guest
   ipconfig Wireless0 192.168.10.20 255.255.255.0 192.168.10.1
   ipconfig Wireless0 ssid GUEST-WIFI psk LobbyGuest2026

   Check: run ipconfig /all on Laptop-Guest and look for IPv4 Address. . . . . . . . . . : 192.168.10.20.

   Why: Joining Wi-Fi and having an IP address are separate layers: association is the layer-2 attachment to an SSID, and the address is layer-3 configuration that rides on top of it. Until an AP is actually advertising GUEST-WIFI the laptop has no layer-2 path at all, so even the ARP for its own gateway has nowhere to go.

5. 5. Put the SSID on the air

   A profile is only a definition until a radio advertises it. Bind GUEST-WIFI to Dot11Radio0, add the AES-CCM cipher that WPA2 expects, choose a channel, and set the radio to serve clients rather than join somebody else's network. The laptop's pending join completes as the radio starts broadcasting, and the ping it could not make a moment ago now works — to the gateway and across the bridge to the wired desk machine.

   On AP-Lobby — Advertise GUEST-WIFI on the radio with the matching cipher

   enable
   configure terminal
   interface Dot11Radio0
   encryption mode ciphers aes-ccm
   channel 6
   station-role root
   ssid GUEST-WIFI
   no shutdown
   exit
   end

   Check: run show dot11 ssid on AP-Lobby and look for GUEST-WIFI WPA2-PSK (key set) broadcast bound.

   Why: Clients can only join a network they can hear, and an AP makes an SSID audible by advertising it from a specific radio — binding the profile to Dot11Radio0 is what starts that. Real WPA2 also expects the AES-CCMP cipher on the radio; in this lab, association checks only the bound SSID and its passphrase, and the cipher, channel and role lines are recorded as configuration.

6. 6. Hand the next guest an address automatically

   A guest network where every visitor waits for an engineer to type an address is not a guest network. Give the router a pool for the same subnet, reserve the low range the infrastructure and your two lab hosts already occupy, and hand out the gateway and a resolver with every lease so a visitor only ever types the passphrase.

   On Edge — Reserve the static range, then serve the rest of the subnet to guests

   enable
   configure terminal
   ip dhcp excluded-address 192.168.10.1 192.168.10.50
   ip dhcp pool GUEST
   network 192.168.10.0 255.255.255.0
   default-router 192.168.10.1
   dns-server 9.9.9.9
   exit
   end

   Check: run show ip dhcp pool on Edge and look for Network: 192.168.10.0/24.

   Why: A bridge forwards broadcasts as faithfully as unicasts, so a guest's DHCP Discover crosses the radio, the AP and the switch and reaches Edge exactly as a wired one would. That is the practical meaning of a bridged AP: one subnet, one pool and one gateway for every guest, however they connect.

The theory behind it

• Wireless LAN fundamentals
• Wireless security — WPA2 vs WPA3
• DHCP — server, relay, and client

More in Switching & wireless

• Map the network with CDP and LLDP — Let two switches and a router discover each other, find the router's address from a switch that was never told it, add LLDP, then stop the router announcing itself toward the internet.
• Two departments, one switch — Split a single switch into Sales and Ops with VLANs, and watch the pings between them stop.
• One VLAN across two switches — Split four PCs into two VLANs across two switches, then carry both VLANs between the switches over a single tagged trunk.
• Router on a stick — Split one switch into two VLANs and route between them over a single router port.
• Route between VLANs on the switch — Give one switch an SVI in each VLAN, find out why the VLANs still can't talk, then turn on ip routing — inter-VLAN routing with no router at all.
• Choose your root bridge — Close a loop of three switches, find the port spanning tree blocks on its own, then decide which switch is root — and which one takes over when it fails.