Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=wireless-SSID-guest-network-create

Create a guest network

Create a guest network to allow clients to connect to the internet and isolate them from private network resources.

You can either use an existing SSID or create a new SSID for a guest network. This procedure describes how to set up a guest network with an existing SSID.

  1. Go to My Products > Wireless > SSIDs and click the SSID for which you want to create a guest network.
  2. Go to Advanced Settings > Client Connection.

  3. Choose the required connection type.

    • LAN: Bridges the client traffic into the same network the access point is connected to.
    • VLAN: Bridges the client traffic into a specific VLAN where the client traffic is isolated from the rest of the network.

  4. Click Enable Guest Network.

  5. Select a Client addressing mode from the following options:

    • Bridge Mode: Clients receive DHCP leases from the customer's DHCP server on the same LAN or VLAN based on the connection type, LAN or VLAN. Clients are allowed to access the internet, but not the private IP addresses. Roaming between access points works flawlessly.

      Note

      Client isolation is automatically turned on for guest networks on AP6 access points. See Client isolation.

    • NAT Mode: APX only. Clients receive IP addresses and DNS details from the DHCP server on the access point. The traffic is NATed to the LAN. Clients can't communicate with each other but can access the internet.

      Restriction

      You can't select NAT mode if you've selected VLAN for Client connection.

      When you select NAT mode, you can enter IP addresses for a Primary DNS Server and a Secondary DNS Server for the access point to assign to clients. If primary and secondary DNS server IP addresses aren't specified, then clients receive the access point's DNS server IP address.

  6. Save your settings.

  7. Give the passphrase to guest network clients.