I run a school network with switches in different departments. All is routed through to a central switch to access the servers.

I would like to install WiFi access points in the different departments and have this routed through the firewall (an Untangle box that can captive-portal the traffic, to provide authentication) before it gets onto the LAN or to the Internet.

I know that the ports that the APs connect to on the relevant switches need to be set to a different VLAN. My question is how do I configure these ports. Which are tagged? Which are untagged? I obviously don't want to interrupt normal network traffic.

Am I correct in saying:

• The majority of the ports should be UNTAGGED VLAN 1?
• Those that have WiFi APs attached should be UNTAGGED VLAN 2 (only)
• The uplinks to the central switch should be TAGGED VLAN 1 and TAGGED VLAN 2
• The central switch's incoming ports from the outlying switches should also be TAGGED VLAN 1 and TAGGED VLAN 2
• There will be two links to the firewall (each on its own NIC), one UNTAGGED VLAN 1 (for normal internet access traffic) and one UNTAGGED VLAN 2 (for captive portal authentication).

This does mean that all wireless traffic will be routed over a single NIC which will also up the workload for the firewall. At this stage, I'm not concerned about that load.