Establishing a secure guest network is a common requirement, yet many implementations on unified threat management platforms either err on the side of being overly permissive or create excessive administrative overhead. The Sophos XGS platform, with its integrated User Portal and flexible firewall rule logic, allows for a more elegant solution: tiered guest access. This guide will detail a method to create distinct access levels—for example, a basic internet-only tier and a premium tier with access to specific internal resources—all managed through a single, branded guest portal.
The architecture hinges on three core components: a shared Guest wireless SSID, Firewall User Groups for each access tier, and corresponding Authentication Schemes that leverage the local User Portal. We will not be using dedicated VLANs for each tier in this design, as the differentiation is handled at the firewall policy level based on user group membership after authentication.
**Step 1: Configure the Shared Wireless SSID and Network**
First, define the guest network zone and IP range. Then, create a wireless SSID that bridges to this zone.
1. Create a new Network Interface (Layer 3) for the guest zone, e.g., `Guest-Network`.
```
IP: 10.10.50.1/24
DHCP server enabled for range 10.10.50.100-200
```
2. In **Wireless > SSID Settings**, create a new SSID (e.g., `Corporate-Guest`). Set its mode to `Bridge to network` and select the `Guest-Network` interface. Configure your preferred security mode (WPA2-Personal is typical for a shared guest key, which will be used only for initial wireless association).
**Step 2: Create User Groups and Local Users for Access Tiers**
We will create two firewall user groups: `Guests-Basic` and `Guests-Premium`. Local user accounts within these groups will be generated via the self-registration portal.
1. Navigate to **Administration > User management**.
2. Create two new groups: `Guests-Basic` and `Guests-Premium`.
3. Optionally, you can create a few manual test users in each group to validate policies before opening registration.
**Step 3: Configure the User Portal for Self-Registration**
This is the critical control point. We will configure a single portal that places users into different groups based on a shared registration key.
1. Go to **Authentication > User portal**.
2. Create a new portal configuration (e.g., `Guest-Portal`). Host it on the `Guest-Network` interface.
3. Under **Self-registration**, enable it and configure:
* **Default user group:** `Guests-Basic`
* **Registration keys:** Here is where tiering is enforced.
* Create a key `BASIC2024` linked to group `Guests-Basic`.
* Create a key `PREMIUM2024` linked to group `Guests-Premium`.
* Customize the portal text to instruct users on which key to use.
**Step 4: Define the Authentication Scheme and Firewall Rules**
The firewall rules will use the authenticated user's group membership to grant appropriate access.
1. Create a new **Authentication scheme** (**Authentication > Schemes**).
* Set `Guest-Portal` as the primary method.
* Under **Common options**, set `Redirect to portal` to `For all users`.
2. Construct the firewall rules in **Protect > Rules and policies**. Order is critical.
* **Rule 1 (Premium Access):** Allow traffic from `Guest-Network` zone to specific internal servers (e.g., a presentation server at `10.10.10.50`). Set `Users/Groups` to `Guests-Premium`. Set `Authentication requirement` to `Any user identified`.
* **Rule 2 (Basic Internet Access):** Allow traffic from `Guest-Network` zone to `WAN` zone. Set `Users/Groups` to `Guests-Basic`. Set `Authentication requirement` to `Any user identified`.
* **Rule 3 (Portal Access & DNS):** Allow traffic from `Guest-Network` zone to the XGS itself (`Firewall` zone) for services `HTTP`, `HTTPS`, and `DNS`. This rule must be placed *above* the user-specific rules and should have `No authentication` required.
* **Rule 4 (Default Deny):** A clean-up rule blocking all traffic from `Guest-Network`. This enforces that only authenticated users matching the above rules can pass traffic.
**Step 5: Testing and Workflow**
The operational workflow is as follows:
1. Guest connects to `Corporate-Guest` Wi-Fi using the shared pre-shared key.
2. Any HTTP request is intercepted by Rule 3 and redirected to the `Guest-Portal` hosted on the XGS.
3. The guest selects "Register now" and enters their details, along with the registration key provided by staff (`BASIC2024` or `PREMIUM2024`).
4. Upon submission, a local user account is created in the corresponding group, and the guest is authenticated.
5. Subsequent traffic is evaluated: a user with the `PREMIUM2024` key will match Rule 1 (to internal resources) and Rule 2 (to internet), while a `BASIC2024` user will only match Rule 2.
This design centralizes management, provides clear audit trails through local user accounts, and uses the firewall's user-aware policy enforcement to create a robust, tiered access system without the need for multiple SSIDs or complex VLAN routing.
null