Small business semi-public wifi netowork help

[Sgent]

So I am a volunteer for a small non-profit (social club), and although not a network engineer, I a somewhat advanced home user (SSL VPN's, QOS, etc., on my home network.

Here's my initial thoughts, but I am probably missing something.

|-Primary WAN
|-Backup WAN
...>VLAN POS (wired clients only), POS machines, this network transacts with credit card information.
...>VLAN OFFICE (wired and wireless clients), owned computers, printers, etc. At least one computer needs access to VLAN POS, maybe more.
...>VLAN VOIP (mostly conference calls).
...>VLAN MEMBERS (wifi private member only network), some may need to access printers on OFFICE.
...>VLAN Guest -- wireless guests only, no password required.

There are about 300 members, with about 50 member clients at the peak usage and about 75-100 guests. We have plenty of wire throughout the building, but one AP cannot cover the entire area.

We currently do not have a server installed on the network, and I would like to avoid that if possible. There are only two non-POS systems, one of which is hardwired. In the case of a failure, ideally only the POS system and manager system would have access.

Additional desirables: incoming VPN, IDP, QoS, etc. Also the ability to block torrenting. We do have 4 fixed IP addresses from the ISP.

My thoughts

--ZyWall USG 50 (it does have a built-in authentication service)
--Netgear FS726TP, 24-port 10/100, 2 Gigabit, 12 PoE (for AP's, Video Conferencing)
-- 2 X AP's (maybe 3), not sure of which ones.

I'm not sure if the AP's really need multiple SSID's, or one with a login screen. Also, any thoughts on the equipment (too limited, etc.) I'm working on a tight budget.

The current equipment is a bunch of home based routers, and AP's, all with different SSID's. The wired portion of the network is controlled by a donated Cisco IOS series switch (not sure which model), which is segregating the POS System. It is not working well as we have a lot of non-members who use the system with no bandwidth limitations, etc.

 

[drebo]

Whatever gateway you use, you need to make sure it supports VLANs and inter-VLAN routing, as well as the ability to restrict access between the VLANs with an ACL. I do not know if your chosen one supports that. I'd recommend a Juniper SRX100 or a Cisco 891/881.

In regards to the access points, you'd be best off with Ubiquiti UniFi.

For the guest SSID, you're always going to want a passkey, even if it's one that's posted in a public place somewhere and freely accessible.

 

[stlcardinals]

Since you mentioned it was a Nonprofit, have they looked at Techsoup.

They have Cisco gear that is donated from Cisco. I've outfitted our Nonprofit with the ASA firewall, 1140 Access Points, and various switches through them for cheap.

 

[skyking]

Since you mentioned it was a Nonprofit, have they looked at Techsoup.

They have Cisco gear that is donated from Cisco. I've outfitted our Nonprofit with the ASA firewall, 1140 Access Points, and various switches through them for cheap.

Thank you for the link. Turns out one of my employers can benefit from that program.

 

[Lithium381]

You need to make sure the POS is COMPLETELY segregated or you risk being in violation of PCI compliance.

You mentioned how many users but not their typical usage patterns. Is it just wide open internet? How big is your internet pipe? 50mbps? Do you have a napkin sketch topology we could look at?

Drebo had some good advice with regards to intervlan routing, as well as make sure the wifi is WPA password protected, even if everyone knows the password...

 

[Lithium381]

Also look at "Untangled" for a free edge solution that operate as a firewall. . . it's got URL filtering by category, anti-spam, anti-virus, etc . . . . i used it at home for a while and it's pretty slick.