Use consumer-grade mesh system in AP mode for segmenting?
-
Just before I started, my new employer (a micro-brewery) bought a TP-Link mesh router system (Deco S4 with ethernet backhaul) to replace the pathetic old 802.11n router that they had been using. I'm trying to implement some better security using a pfSense router and potentially VLANs to really isolate the guest network. The TP-Link units (there are 3 of them) can be configured for WAP mode but I don't believe I can specify different subnets for the Main and Guest SSIDs (and I have no idea how good the isolation is between those 2 SSIDs). Can anyone speak to that?
I suspect the general consensus is going to be "just go with Unifi/Omada/etc." but I'd rather not be that guy (who says, "It's all crap, we need to scrap 'em and get...") If I can find a decent way to put these to use and still achieve good isolation between the work and guest networks, the new boss is sure to appreciate that.
Comments? Suggestions?
-
It really depends whether you can apply different VLANs to different SSIDs on those.
Many of those mesh devices are limited when in bridge mode. Also some I have seen only allow running a guest SSID with NAT on the mesh router back to the main subnet which limits what filtering you can do.
First determine exactly what those mesh devices are capable of.
Steve
-
@stephenw10 Thanks. Figuring out what those units are capable of has been somewhat difficult. TP-Link support hasn't been very helpful. These are a consumer-grade product so I'm working with that level of support techs - and this is more of a business application.