Network labs Docs Open simulator →

Guest WLAN — DMZ anchor + lobby-ambassador users + sleeping client

The canonical Cisco-style guest deployment, in three knobs. Mobility anchor (Slice Y1): a WLAN can list one or more anchor controllers (DMZ-side WLCs that terminate guest traffic on a separate Internet-egress segment); show wireless mobility anchor reports per-WLAN anchor status with resolved/unresolved verdict against the local mobility-peer table. Guest user database (Slice Y2): a local user catalog the lobby-ambassador role manages — username, password, validity window, lifetime; show wireless guest-user summary reports active / expired / pending state. Sleeping client (Slice Y3): a per-policy-profile timeout; web-auth clients that disassociate and reconnect within the window skip the captive-portal redirect.

Open this lab in your browser →

Free · no install · no account

Scenario

Together these three close the gap between "we can broadcast a guest SSID" (Slice X) and "we can ship a real guest network operators would actually run." All three are config + show — no new datapath. On a real Cisco deployment, guest traffic typically gets *anchored* onto a separate WLC that lives in the DMZ. The branch-office WLC ("foreign") tunnels the WLAN's traffic via the mobility tunnel to the anchor WLC; clients receive DMZ IPs there and only egress through the anchor's Internet uplink. This keeps guest traffic completely separate from corporate L2/L3. The simulator stores anchor names as strings on wlanConfig.anchorControllers. Names should match an entry in the local mobilityPeers table (Slice S). show wireless mobility anchor reports per-WLAN anchor status with resolved (ip, group) or unresolved verdict — the canonical "I typo'd the anchor name" failure mode. Real Cisco WLCs carry a local user database that a lobby-ambassador user (a restricted admin role) populates with time-bounded guest accounts. device.wireless.guestUsers carries the catalog: username, password, optional validity window (validFrom / validUntil as ISO-8601 strings), and operator-friendly lifetimeSeconds. show wireless guest-user summary walks the catalog and computes a state per user: active (within the validity window), expired (validUntil is in the past), or pending (validFrom is in the future). Web-auth WLANs prompt clients to log in via captive-portal redirect. Without sleeping-client cache, every reconnect (laptop wakes from sleep, phone rejoins the network) re-prompts. policyProfile.sleepingClientTimeout: number | null configures the cache window; reconnects within the window skip the redirect. The simulator stores the timeout but doesn't yet model the captive-portal interception itself — the surface is config + verification only.

Topology

1 × wireless controller · Cisco IOS-XE-style

What you will do

  1. On WLC1, run show wireless mobility anchor. The guest-wifi WLAN should anchor to DMZ-WLC, resolved against the mobility peer table.

  2. Run show wireless guest-user summary. Three users: alice (active), bob (expired), carol (pending).

  3. Run show wireless profile policy detail GUEST-POL. Sleeping-client timeout should be 7200s.

Open this lab in your browser →

More labs on this topic

This lab in other languages

Gast-WLAN – DMZ-Anker + Lobby-Botschafter-Benutzer + schlafender ClientWLAN para invitados: ancla DMZ + usuarios embajadores del lobby + cliente dormidoWLAN convidada — âncora DMZ + usuários embaixadores do lobby + cliente adormecidoWLAN invité — Ancre DMZ + utilisateurs lobby-ambassadeur + client endormiअतिथि WLAN - DMZ एंकर + लॉबी-राजदूत उपयोगकर्ता + स्लीपिंग क्लाइंट访客 WLAN — DMZ 锚点 + 大堂大使用户 + 睡眠客户端WLAN ospite: ancoraggio DMZ + utenti lobby-ambassador + client dormienteゲスト WLAN — DMZ アンカー + ロビーアンバサダー ユーザー + スリープ クライアント게스트 WLAN — DMZ 앵커 + 로비 대사 사용자 + 잠자는 클라이언트Гостевая WLAN — якорь DMZ + пользователи лобби-амбассадора + спящий клиентKonuk WLAN — DMZ sunucusu + lobi elçisi kullanıcıları + uyuyan istemciWLAN khách - Cố vấn DMZ + người dùng đại sứ vận động hành lang + khách hàng đang ngủ