A guest network is a second wireless network, with its own name and usually its own password, broadcast beside the staff network. NIST's wireless security guidelines, SP 800-153 (published in 2012), say devices on a guest network should not be able to connect through it to devices on the organization's other wireless networks, and that a guest network set up mainly for internet access should be designed so its traffic does not cross the internal network.

The FTC's home Wi-Fi advice gives two reasons to use one: fewer people have your main Wi-Fi password, and malware a visitor unknowingly carries on a phone or tablet stays off your primary network. Both depend on the separation working, so the test matters as much as the setup.

Decide what the guest network is for

List who will use it and what each group needs. Most needs fall into one of three groups:

  • Internet only, which covers most visitors and clients in the waiting room.
  • Internet plus one named device, such as the reception printer.
  • Access to office files or systems, which is not a guest need and belongs on the staff network.

A client who wants to print, or a contractor who must reach one device, is an exception to plan, not a reason to open the whole network. NIST says a guest network that needs internal access should reach only the necessary hosts or subnets, using only the required protocols.

Then decide how people will join. A passphrase keeps out people who were never given it, and changing it cuts off past visitors. An open network is easier, but Apple strongly discourages settings that turn security off, such as None, Open or Unsecured, and says the risk applies even to a guest network: anyone can join, reach shared resources such as printers and monitor the websites people visit. The eero app lets you leave the guest password blank, and warns that doing so turns off your Wi-Fi protection.

If you want visitors to join without a password, check whether your equipment supports Wi-Fi Enhanced Open. The Wi-Fi Alliance says it provides unauthenticated data encryption with no public passphrase to maintain or share, so traffic is encrypted but anyone in range can still join. Cisco Meraki calls the option Opportunistic Wireless Encryption (OWE).

Create the network

Start in the management app or admin page for your router or access points. If the administrator login is still the default, change it first. The FTC says a router has two passwords to reset, the Wi-Fi network password and the router admin password, and advises against login names or passwords that use your name, address or router brand.

Look for the guest option, which vendors name differently. In the eero app, open the Settings tab, tap Guest wifi network, turn on Enable guest network and tap Save. On Cisco Meraki access points a guest network is another SSID, enabled and renamed under Wireless, Configure, SSIDs, with its security chosen under Association requirements on the Access control page.

Give it a distinct name so people can tell it apart from the staff network; the eero app requires the guest name to differ from the main one. Apple recommends one name across all bands for any network and says separate 2.4 GHz, 5 GHz or 6 GHz names can make connections unreliable, so avoid band-specific guest names. Choose a separate passphrase if your setup requires one, never the staff passphrase or a variation of it. If you manage several access points, check that the guest network is enabled only where visitors need it, and apply the same settings on every unit that broadcasts it, as Apple advises.

Pick the strongest security mode your equipment supports. Apple recommends WPA3 Personal, or WPA2/WPA3 Transitional for compatibility with older devices, with WPA2 Personal (AES) when neither can be used. Because you cannot control what visitors bring, Transitional is often the practical choice for a guest network; on Meraki the equivalent is the WPA3 Transition Mode encryption setting. Apple's list of weak settings to avoid includes WPA/WPA2 mixed modes, WPA Personal, WEP in any of its forms and any setting with TKIP in the name.

If your router offers only WPA or WEP, the FTC says to try a software update first and, if WPA2 or WPA3 still is not available, to consider a new router. While you are in the settings, the FTC also advises turning off remote management, WPS and UPnP, checking that the router's firewall is on and logging out as administrator when you finish. If an IT provider manages the network remotely, ask before turning remote management off. Apple recommends setting the router to install software and firmware updates automatically where possible.

Find the setting that keeps guests apart

Separation usually comes from two controls. One keeps guests from reaching the office's private addresses, often by giving them their own address range behind a firewall rule. The other, called client isolation, stops guest devices from reaching each other.

Some consumer systems apply both automatically. On an eero network, guest devices get addresses from a separate subnet that does not overlap the main network, and eero says they cannot communicate with main-network devices or with each other. So a guest laptop cannot stream music to a speaker on either network.

Where you have a choice, review the setting that controls access to the local network. The name varies by vendor. Some call it guest isolation or access to the intranet. For a normal visitor network, you generally want internet access without access to staff devices, private printers, or shared storage.

Cisco Meraki access points offer both controls. The first is the Layer 3 firewall rule whose destination is Local LAN, under Wireless, Configure, Firewall & traffic shaping; Meraki's guest network guide labels it Wireless clients accessing LAN. Setting it to Deny blocks that SSID's clients from the private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 while leaving internet access. DNS and DHCP traffic is exempt, so guests can still get an address and look up names.

The second is client isolation. Meraki's is available but off by default in bridge mode, where clients get addresses from the office network's DHCP server, while basic isolation is always on in NAT mode, where the access points hand out their own addresses. Meraki says isolated clients can talk only to the default gateway, not to other devices on the same VLAN, but traffic bound for other VLANs is still forwarded and routed normally. So isolation is not a substitute for the Local LAN rule.

NAT mode clients get addresses in 10.0.0.0/8, yet Meraki's own simple guest setup still sets the LAN rule to Deny in NAT mode. Check the rule rather than trusting the address range.

Plan any printer exception

If your visitors need a printer, plan that exception deliberately with whoever manages the network. The narrow version lets guests reach one device instead of switching isolation off. If visitors rarely print, the simplest exception is none, because a staff member can print the file for them.

On Meraki, the narrow version is an additional Layer 3 rule allowing the printer's address and port, placed above the Local LAN rule. Firmware MR 31.1.6 and later can also let up to 16 MAC addresses through client isolation, with a shared printer as Meraki's example.

Reaching a printer and finding it are separate problems. Meraki says that to allow same-subnet Bonjour print services, you add two multicast MAC addresses, the IPv4 and IPv6 mDNS addresses, to the isolation exception list. If guests cannot see the printer, adjust the exception rather than turning isolation off.

Test that it stays separate

On a staff device, note the addresses of a printer, a shared drive and the router's admin page, all devices you control. On a Mac, System Settings, Wi-Fi, Details shows the router's address as Router; on a Windows PC, the ipconfig command shows it as the default gateway. A printer's address is usually in its network settings menu.

Test from a phone or laptop connected only to guest Wi-Fi, with cellular data off, no network cable plugged in and the staff network forgotten so it cannot switch back. On a Mac, Forget This Network is in the same Details panel. A spare device is easiest, because a device that forgets the staff network needs the staff passphrase to rejoin it.

To try a shared drive from a Windows laptop, type two backslashes and its address into the File Explorer address bar, for example \\192.168.1.20. On a Mac, choose Go, Connect to Server in the Finder and type smb:// followed by the address and the share name, the format Apple gives for Windows file servers.

Then work through these checks:

  • Confirm the device shows the guest network name.
  • Check the address it received, since a range different from staff devices is a good sign but not proof.
  • Load a normal website.
  • Type the printer's address into a browser and check that its settings page does not load.
  • On a laptop, try to open the shared drive by its address.
  • Try the admin page, and if it loads, ask whoever manages the network whether that is expected.
  • If you made a printer exception, check that the allowed printer works and nothing else does.
  • Repeat the checks near each access point that broadcasts the guest network, since units can behave differently; Meraki, for example, says bridge mode client isolation is not currently supported on mesh repeaters.
  • Switch back to staff Wi-Fi and check that the staff device still works.

Do not count an empty Network view in File Explorer as a pass. Microsoft says you need to turn on network discovery to see devices on the network that are sharing files, so a blank list can simply mean discovery is off.

If anything on the private side loads, stop handing out the guest passphrase until it is fixed. Write down the date, the device and the results, along with where the guest password is kept and who can change it when needed. If you cannot tell whether your router separates the traffic, consult its documentation or your network administrator before relying on the setting.

Keep it separate over time

Repeat the test after firmware updates, new equipment or any change made for a visitor, since Apple notes that updates can affect the security settings available to you. NIST calls for a technical wireless security assessment at least annually, plus periodic assessments at least quarterly unless continuous monitoring already collects the information needed. A small office without such monitoring can at least rerun the guest test each quarter.

NIST recommends standardized security configurations for wireless components such as access points, maintained in a way that lets you detect and correct unauthorized changes. In a small office that can be a one-page record of the guest network's name, security mode, isolation settings and exceptions, with who approved each one. Compare the live settings with it at each retest and remove exceptions nobody needs.

Change the guest passphrase whenever a long-term contractor or employee leaves, and on a schedule you can keep. Every device that saved the old passphrase will need the new one, so replace the front-desk card the same day, along with any QR code. The eero app, for example, can show a QR code that visitors scan to join.

NIST also warns about dual-connected devices, such as a computer on the wired network that is also joined to a wireless one, which an attacker with wireless access could use to reach the wired network. Keep staff computers that are on the office network off the guest Wi-Fi.

Common mistakes and how to spot them

  • A guest passphrase that matches, or nearly matches, the staff one, which shows when you compare the two entries in your password manager.
  • Isolation switched off to make a printer work, which shows when the test reaches devices other than the printer.
  • A hidden network name, which Apple says neither conceals the network from detection nor secures it against unauthorized access.
  • MAC address filtering used as protection, which Apple advises against because addresses can easily be copied, spoofed or changed.
  • A weak security mode left over from an old router, such as WEP or anything with TKIP in its name.
  • An open guest network copied from a quick-start guide, such as Meraki's simple guest guide, which uses Open (no encryption), a setting Apple strongly discourages.
  • A guest passphrase unchanged for years after contractors and former staff have used it.
  • A test that passed only because the phone was on cellular data, or failed only because it quietly rejoined the staff network, which you avoid by checking the network name and address before each check.
  • A forgotten router plugged into an office network jack and still broadcasting Wi-Fi, which shows when test results differ from room to room.

A worked example

Imagine an eight-person insurance agency with three access points, one each at reception, in the conference room and in the back office. Visitors need the internet, and some need the reception printer, but nothing else on the office network.

The office manager sets up a guest network with its own name, WPA2/WPA3 Transitional security and a passphrase printed on a card at the front desk. She turns it on only at the reception and conference-room access points, blocks local network access, turns on client isolation and has the agency's IT provider add a narrow exception for the reception printer.

Before testing, she notes the reception printer, file server and router addresses from her staff laptop. Then she takes a spare phone, forgets the staff network, turns off cellular data and joins the guest network.

Near reception, a news site loads and a test page prints, while the file server, back-office copier and admin page do not respond. In the conference room, the copier's settings page loads, and the phone shows an address in a different range from the one it got at reception. The IT provider traces it to an old wireless router someone plugged into a network jack years ago, broadcasting under the same guest name with nothing blocking the office network behind it. The provider removes that router, and the conference-room retest passes.

A work laptop on staff Wi-Fi still prints and opens the file server. The office manager records the date, device and results in the agency's password manager beside the passphrase, adds the settings to a one-page network record and sets a reminder to retest next quarter.

What to do this week

  • Find out who holds the router admin account and whether its default password was changed.
  • Confirm the guest network has its own name, is not hidden and uses WPA3 Personal, WPA2/WPA3 Transitional, WPA2 Personal (AES) or Enhanced Open, with any passphrase different from the staff one.
  • Check the setting that blocks guest access to the local network, and client isolation if your system offers it.
  • Write down the printer, shared drive and router addresses, then run the guest test near each access point.
  • Turn on automatic firmware updates if your router supports them.
  • Record the results, where the passphrase is kept and who can change it, and book the next test.

Short answers to common follow-up questions

A splash page is optional. It shows a welcome or terms page before guests get online, but it is a separate setting from security. Meraki, for example, sets the Splash page apart from the Association requirements, with choices such as None (direct access) or a click-through page showing a company logo or welcome message.

A click-through page on an Open (no encryption) network still leaves traffic unencrypted. If you want a splash page and encryption without a passphrase, look at Enhanced Open: the Wi-Fi Alliance lists interoperability with legacy networks, even those using a captive portal, among its benefits, and Meraki's WPA3 guide says OWE can be used on open networks and on those with captive portals. Test the combination on your own equipment before relying on it.

Guests share your internet connection, so heavy guest use can slow staff work. Business systems can cap it; on Meraki, the Traffic shaping rules section of the Firewall & traffic shaping page takes a per-client and a per-SSID bandwidth limit.

You do not need separate access points. The same units can broadcast staff and guest networks side by side, as Meraki's guide to simple guest and internal networks shows.

Staff members' personal phones can use the guest network when they need only the internet. That keeps the staff passphrase off devices the office does not manage, which is the FTC's first reason for having a guest network.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho. Its managed networking service includes separate networks for staff, guests and devices, along with firewall rule reviews and device isolation, and its UniFi by Ubiquiti service can put guests on their own network with a captive portal if you want one. On-site work is scheduled, and the ALCO help desk is staffed 24 hours a day, including holidays, with calls answered by a person.

Sources