Skip to content
Login
Knowledge base
Guest Wi-Fi

SnapGuard IT setup: one trunk port on a managed network

For the venue's IT company: one trunk port, guest VLAN 912, an open SSID and an outbound tunnel. The settings, firewall rules and fixes.

5 min read

In short: give the SnapGuard one trunk port (your LAN native, guest VLAN 912 tagged), bridge one open SSID to 912, and allow its tunnel out.

This guide is for the IT company that runs the venue's network. Your WAN can be anything: fibre, Starlink, cellular or bonded ADSL. If the tunnel is up, everything works.

SnapGuard on a managed networkThe native line runs from the internet through your router and switch to the SnapGuard; guest VLAN 912 runs from guests through the access points to the same switch port; the tunnel runs outbound from the SnapGuard to Stampede at vpn.stampede.ai.Tunnel, outboundSnapGuardGuest gateway, portal,tunnel homeStampedevpn.stampede.aiYour switchOne trunk port,native + 912 taggedAccess pointsOpen SSIDon VLAN 912GuestsYour routerDHCP for your LAN onlyThe internetAny WAN: fibre, Starlink,4G/5G, bonded
  • Native · your LAN, untagged
  • Guest VLAN 912 · tagged
  • Tunnel · outbound to Stampede
three lines, one cable into the box

What the box is, and is not

The SnapGuard is a pre-set guest Wi-Fi gateway. It runs the portal, guest DHCP and NAT, and opens one outbound tunnel home.

It is not your router, firewall or DHCP. It is not an access point or controller. It touches nothing on your LAN.

It needs one trunk port, one open SSID bridged to the guest VLAN, and outbound internet only. Every other SSID, VLAN and device carries on exactly as today.

The SnapGuard sits beside your network, not inside itYour access point keeps every SSID it runs today; staff, POS and events VLANs carry on through your router unchanged, and only the guest SSID on VLAN 912 goes to the SnapGuard.Your access pointAs many SSIDs as you run todayStaff · VLAN 10POS · VLAN 20Events · VLAN 30Guest · VLAN 912Your routerUnchanged, DHCPfor your LANSnapGuardGateway + DHCPfor 912 onlyOnly 912 turns toward the box.Everything else carries on as today.
beside your network, not inside it

The three lines

  • Native line: your LAN, untagged. It gives the box an address and the internet. Your router runs DHCP here and only here.
  • Guest VLAN line: guests only, tagged. It runs from the access points to the box and nowhere else. The box is its gateway and its only DHCP server.
  • Tunnel: the encrypted connection the box opens outbound to Stampede. Nothing for you to build.

The guest VLAN ID

Every box ships configured for one guest VLAN ID. 912 is the default, and this guide uses it throughout. Your setup email states the ID on your box. If 912 is already taken on your network, we provision a different one. The ID in your controller must match the ID on the box.

The four settings

Each vendor names these differently. See SnapGuard vendor playbooks for your controller's exact menus.

  1. 01 · Layer 2 onlyVLAN 912 exists and is empty
    VLAN 912 exists and is emptyVLAN 912 is a layer-2 network only, with its gateway address, DHCP scope and routing all off.VLAN 912LAYER 2 ONLYGATEWAY ADDRESSOFFDHCP SCOPEOFFROUTINGOFF
  2. 02 · Native + 912 taggedThe SnapGuard port is a trunk
    The SnapGuard port is a trunkOne switch port carries your LAN untagged as native and VLAN 912 tagged, into SnapGuard port 1.Switch port12SnapGuardPort 1NATIVE UNTAGGED · 912 TAGGED
  3. 03 · Native + 912 taggedEvery access point port is the same trunk
    Every access point port is the same trunkThree access point ports, each carrying both the native network and VLAN 912.SWITCHSAME TWO LINES ON EVERY AP PORT
  4. 04 · Portal offAn open SSID bridged to 912
    An open SSID bridged to 912A phone joins an open SSID bridged to VLAN 912 and reaches the SnapGuard; the vendor's own portal is off.Guest Wi-FiOpen, bridged to 912SnapGuardVENDOR PORTALOFF
the four settings

1. VLAN 912 exists and is empty

Create VLAN 912 as a layer-2 network only: no gateway address, no DHCP scope, no routing. If the controller insists on a router, choose the third-party or none option.

Why: the box is the gateway and the only DHCP server on 912. Two answers make the portal a coin toss.

2. The SnapGuard port is a trunk

On the switch port the box plugs into, set your LAN untagged as native and 912 tagged.

Why: the box needs your LAN for its own internet and 912 for guests.

3. Every access point port is the same trunk

Repeat setting 2 on every AP port, and on any uplink the guest traffic crosses.

Why: drop the tag anywhere on the path and guests never reach the box.

4. An open SSID bridged to 912

Set security to open, with WPA2 and WPA3 strictly off. Bridge the SSID to VLAN 912, not to the controller and not NAT. Turn off the vendor's portal, splash page or hotspot on that SSID.

Why: the SnapGuard is the portal. A password or vendor splash page catches the guest first.

The tunnel and firewall

One tunnel out through your firewall, nothing inFrom its LAN address the SnapGuard opens one outbound tunnel through your firewall to Stampede: UDP 51820 to vpn.stampede.ai, TCP 443 and DNS out, and no inbound rule.TCP 443 + DNSto anywhereUDP 51820Nothing inSnapGuardLAN addressYour firewallOutbound onlyStampedevpn.stampede.ai
one tunnel out, nothing in
  • Allow outbound from the box's LAN address: UDP 51820 to vpn.stampede.ai, and TCP 443 and DNS to anywhere.
  • Add no inbound rule and no port forward. Nothing calls in.
  • Exempt the box's LAN address from TLS inspection, application control and any captive portal of your own.
  • Give the box a DHCP reservation.

Why: the tunnel carries provisioning, health and remote support. Without it the box reads offline even when guests are fine. Every guest leaves NATed behind the box's address, so a portal on it catches every guest.

A firewall in front (SonicWall, Sophos, WatchGuard, pfSense) needs nothing for VLAN 912. Make sure it runs no guest services or captive portal on the zone the box plugs into.

Optional extra VLANs

The four settings are all the box needs. Other venue traffic can ride its own VLAN on the same cable. Ask at provisioning: the box arrives configured, and your setup email lists the IDs to tag alongside 912.

  • POS: card terminals, tills and handhelds, so payment traffic never shares a broadcast domain with guests.
  • Staff: a password-protected SSID for the team, which keeps working through any portal change.
  • CCTV: cameras and recorders, invisible to guests and the internet.
  • Sonos and everything else: speakers, kitchen screens, alarms, door hardware, EPOS. Sonos needs multicast, and a device VLAN keeps it off 912.

Already run your own POS, staff or camera networks? Leave them as they are.

In the cabinet

Your port numbers will differ, but the shape will not: one lead from the box to a switch trunk port, and the same trunk on every AP port. Each model runs the same software and the same four settings.

Which box landed?
The cabinet, with the hAP ax²A 12U cabinet: two ceiling access points cabled to patch panel ports 1 and 2, patched to switch ports 1 and 3; the router on LAN 1 to switch port 24, the ISP modem on its WAN; the SnapGuard on the shelf with port 1 as the trunk to switch port 12; spare units and a PDU.CEILINGCeilingOPEN SSID · VLAN 912OPEN SSID · VLAN 9121U2U3U4U5U6U7U8U9U10U11U12UPATCH PANEL17131924SYS13SFP+SWITCH1224ISP MODEMWAN INLANROUTERWANLAN 141 · POE IN5SNAPGUARDSPAREPDUAP LEADS · LAN + 912 TAGGEDROUTERLAN ONLYTRUNK · 912 → BOX1234567
  1. 1Ceiling access pointsOpen SSID bridged to 912, cabled to the panelOpen SSID · VLAN 912
  2. 2Patch panelAPs land on 1 and 2
  3. 3Cable managersEvery lead dresses through one
  4. 4Your switchAPs on 1 and 3, SnapGuard 12, router 24
  5. 5Your routerLAN 1 to switch port 24, the ISP modem on its WAN
  6. 6SnapGuardhAP ax² on the shelf, port 1 is the trunk
  7. 7PowerThree leads to the PDU

Ink leads are ordinary patch cables. The one gradient lead is the trunk, switch port 12 to SnapGuard port 1.

hAP ax². 5× Gigabit, Wi-Fi 6 dual-band, PoE-in on port 1. Quad-core ARM64, 1 GB RAM. The shelf or wall box. Same software, same four settings.

the same lines in the cabinet
  • hAP ax²: shelf or wall box. 5× Gigabit, Wi-Fi 6 dual-band, PoE-in on port 1. Quad-core ARM64, 1 GB RAM.
  • RB5009: 7× Gigabit, 1× 2.5G, 1× SFP+ 10G. Quad-core ARMv8, 1 GB RAM. Four mount in a single 1U with the rack kit.
  • CCR2004-16G-2S+: the 1U core for big sites. 16× Gigabit, 2× SFP+, 4 GB RAM, dual redundant PSU.

When it fails

Guests connect, no portal, straight online

The SSID is on your LAN, or your router answers DHCP on 912. Check setting 1.

Guests connect, no portal, no internet

912 is not reaching the box. Check the trunk on the box port and the AP ports.

Guests get a Wi-Fi password prompt

WPA2 is still on. Security must be Open or None.

Portal loads, then a different login page

Your controller's hotspot or splash page is on. Turn it off.

Guests fine, box shows offline in Stampede

The tunnel is blocked. Check the outbound rule for the box's address. See SnapGuard offline.

Check it worked

Join the guest SSID on a phone. It should get an address from the box's range in your setup email, never your LAN. Open any http page and the Stampede portal appears. In Stampede, Provisioning, API and VPN should all be green.

Email support at agent@stampede.ai with:

  • The venue name.
  • The controller make and model.
  • Screenshots of the guest network, SSID and switch port settings.

Good to know

  • The guest VLAN ID must match the one in the setup email.
  • Only native and 912 are needed. The box never touches your other networks.
  • To set up the box itself in Stampede, see set up a new SnapGuard box.
  • RADIUS, portal URL and walled garden setup is a different path. See connect your own Wi-Fi hardware.
  • All this is done in the venue's own switches and controller, by whoever manages them.
Related searches

Related articles

All Guest Wi-Fi articles

Still stuck, or have account-specific questions?

  1. Log in to stampede.ai
  2. Press Command + /On Windows, press Ctrl + /.
  3. Ask the agentIt answers about your own venues and account.
Log in to stampede.ai