Wireless (4th interface?) 'how-to' concerns

[Robert Kaye]

HISTORY
Hi everyone, i've been away from the forums for awhile, it's nice to see so many familiar names still around... We're looking for a new firewall at work, so I thought I'd come back to my old haunt(s).

Part of the feature set we're trying to fulfill is to have ye' ole basic wired firewall, but they also want to be able to provide wireless access to employees (wherein they want to allow wireless employees to access parts of the trusted network *panic*), and also have some bandwidth dedicated to the general public as a community hotspot.

A couple of firewalls have a fourth type of interface (untrusted/red, trusted/green, dmz/orange, blue/wifi) wherein wireless is the second dmz.

SUGGESTION/PROBLEM
I dont see these related topics addressed in the install process: Multiple DMZs, adding a wireless hotspot, where a wireless router should be placed (i know this might seem trivial to you, but a collegue at a diff 1000-person company added a wireless router *inside* the trusted, thinking that if he merely set the router to allow only certain mac addresses that was ok), and specificly the idea of "trusted" wireless routers.

With the free public hotspot movement, it seems remiss not to wave a flag.

[BarryG]

Multiple DMZs are allowed.

Recommend either:
put an AP in a DMZ, and let everyone connect to it, and employees use a VPN client to get into the internal network(s).
or
2 DMZs, 2 APs, one public, one private using WPA etc.

Barry

[BrucekConvergent]

What Barry said. We often have customers that want to be able to use Wireless in their conference room, etc... so we often use an access point with WPA, with no access allowed to the internal network or WANs. If it's an employee that needs access to internal resources, we slap the OpenVPN client on the laptop and have them connect through the wireless that way.

[Robert Kaye]

Thanks Barry & Bruce, a single WPA with employees using VPN will work perfectly.

[BAlfson]

Bruce, why the OpenVPN client for a Windows laptop? We've set up L2TP over IPSec since XP and it's been totally without problems. I admit to ignorance on this issue.

Thanks - Bob

[BrucekConvergent]

There have been different problems with L2TP in the past. I rather like the OpenVPN (SSL Client) as it uses certs in addition to user authentication.

[BAlfson]

OK, it sounds like we each have solutions we're comfortable with.

As always, thanks for your time and knowledge here. - Bob