Skip to content
Login
Knowledge base
Guest Wi-Fi

SnapGuard vendor playbooks: the four settings in your controller

The four SnapGuard settings in your controller's own menus: UniFi, DrayTek, Fortinet, Meraki, Omada, Aruba, Ruckus, Mist, Netgear, Zyxel, MikroTik, Cisco/HP.

8 min read

In short: find your controller below and set the four settings with the exact options in bold. Use your setup email's VLAN ID if it is not 912.

These are the four settings from SnapGuard IT setup: one trunk port on a managed network, in each product's own menus. Check is how to confirm it. Trap is the setting that most often breaks it.

  1. 01 · Layer 2 onlyVLAN 912 exists and is empty
    VLAN 912 exists and is emptyVLAN 912 is a layer-2 network only, with its gateway address, DHCP scope and routing all off.VLAN 912LAYER 2 ONLYGATEWAY ADDRESSOFFDHCP SCOPEOFFROUTINGOFF
  2. 02 · Native + 912 taggedThe SnapGuard port is a trunk
    The SnapGuard port is a trunkOne switch port carries your LAN untagged as native and VLAN 912 tagged, into SnapGuard port 1.Switch port12SnapGuardPort 1NATIVE UNTAGGED · 912 TAGGED
  3. 03 · Native + 912 taggedEvery access point port is the same trunk
    Every access point port is the same trunkThree access point ports, each carrying both the native network and VLAN 912.SWITCHSAME TWO LINES ON EVERY AP PORT
  4. 04 · Portal offAn open SSID bridged to 912
    An open SSID bridged to 912A phone joins an open SSID bridged to VLAN 912 and reaches the SnapGuard; the vendor's own portal is off.Guest Wi-FiOpen, bridged to 912SnapGuardVENDOR PORTALOFF
the four settings

UniFi Network

  • VLAN: Settings › Networks › New. Router Third-party Gateway, VLAN ID 912. UniFi hides DHCP for third-party networks, which is what you want.
  • Ports: Devices › switch › Port Manager › SnapGuard port and every AP port. Native Default, Tagged VLAN Management Allow All or Custom including the 912 network.
  • SSID: Settings › WiFi › New. Network the 912 network, Security Open, Hotspot Portal off, Client Device Isolation off.
  • Portal: WiFi form › Hotspot Portal off. Settings › Hotspot: no landing page assigned to this network.
  • Check: Devices › switch › port shows the 912 network under Tagged. Clients lists the SnapGuard with a Default-network IP.
  • Trap: the Hotspot toggle on the WiFi form. On means UniFi's own portal catches guests first.

DrayTek Vigor

  • VLAN: Router: LAN › VLAN, enable, add a row with VLAN Tag 912 bound to a spare subnet such as LAN2. LAN › General Setup › LAN2: DHCP Disable. Do not use LAN1.
  • Ports: router LAN ports and any VigorSwitch port to the box or an AP: trunk, PVID 1, tagged member of 912. VigorSwitch: VLAN › 802.1Q › Port Setting.
  • SSID: VigorAP: Wireless LAN › General Setup › a spare SSID slot. VLAN ID 912, Security › Mode Disable. The AP's LAN port must receive 912 tagged.
  • Portal: Hotspot Web Portal › Disable for LAN2 and for the LAN the box sits on.
  • Check: Diagnostics › DHCP Table shows the box on LAN1 only, and nothing on LAN2.
  • Trap: Hotspot Web Portal left on for the subnet. DrayTek intercepts the first web request.

Fortinet

  • VLAN: FortiGate: Network › Interfaces › Create › VLAN on the LAN-facing interface. VLAN ID 912, IP 0.0.0.0/0, DHCP Server off. Managed FortiSwitch: WiFi & Switch Controller › FortiSwitch VLANs, same values.
  • Ports: FortiSwitch Ports › SnapGuard port and AP ports. Native VLAN your LAN, Allowed VLANs 912.
  • SSID: WiFi & Switch Controller › SSIDs › Create. Traffic mode Bridge, VLAN ID 912, Security Open, Captive Portal off.
  • Portal: SSID › Captive Portal off. No security profile with a captive portal on the 912 interface.
  • Check: interface 912 shows no DHCP leases. The FortiAP SSID page shows Bridge, not Tunnel.
  • Trap: FortiGate clusters that hand out DHCP on every VLAN. If 912 gets a scope, guests get two offers and the portal is a coin toss. Tunnel traffic mode sends guests to the FortiGate, bypassing the VLAN.

Cisco Meraki

  • VLAN: MX: Security & SD-WAN › Addressing & VLANs › add VLAN 912 with DHCP Do not respond to DHCP requests. Skip if the MX is not the layer-3 gateway.
  • Ports: Switching › Switch ports › SnapGuard and AP ports. Type trunk, Native VLAN 1, Allowed VLANs all.
  • SSID: Wireless › SSIDs › new. Access control Open, Splash page None, Client IP assignment Bridge mode, VLAN tagging 912.
  • Portal: SSID › Splash page None. Wireless › Firewall & traffic shaping: no per-client limits on this SSID.
  • Check: switch port detail shows trunk, allowed 912. The Clients page shows the box on VLAN 1.
  • Trap: NAT mode on the SSID. Meraki hands out its own addresses and the SnapGuard never sees the phone.
  • VLAN: Settings › Wired Networks › LAN › Create. Purpose VLAN, not Interface. VLAN 912.
  • Ports: Devices › switch › Ports › SnapGuard and AP ports. Profile All, or a custom profile with native LAN and 912 tagged.
  • SSID: Wireless Networks › Create. Security None, VLAN Custom 912, Guest Network off.
  • Portal: Authentication › Portal: none on this SSID. Access Control: no client isolation.
  • Check: Wired Networks lists 912 with purpose VLAN and no gateway.
  • Trap: Purpose Interface. It gives the Omada gateway an address and DHCP on 912.

Aruba Instant On

  • VLAN: nothing to create. The VLAN exists once a network or port references it.
  • Ports: Inventory › switch › Ports › SnapGuard and AP ports. Untagged Default, tagged 912.
  • SSID: Networks › Add. Type Employee, Security Open, Network assignment Specific VLAN 912.
  • Portal: none. Instant On only offers a portal on its Guest type, which you are not using.
  • Check: clients on the SSID show a SnapGuard-issued address.
  • Trap: the Guest network type. It exists to run Aruba's own portal and NAT.

Ruckus

  • VLAN: ICX switch, with no router interface:
vlan 912
  • Ports: on ICX, tag the box and AP ports. Untagged membership stays in your LAN VLAN.
tagged ethe 1/1/x
  • SSID: Unleashed or Ruckus One: Wi-Fi Networks › Create. Usage Standard, Encryption None, Advanced › Access VLAN 912.
  • Portal: Usage Standard means no Ruckus portal. Client Isolation off.
  • Check: this lists the box and AP ports as tagged.
show vlan 912
  • Trap: Usage Captive Portal or Hotspot. Standard is the one you want.

Juniper Mist

  • VLAN: Org › Networks › add network 912. No subnet, no gateway.
  • Ports: port profile with Mode trunk, Port Network your LAN, trunk Networks 912. Apply it to the box and AP ports.
  • SSID: WLANs › Create. Security Open, VLAN Tagged 912, Guest Portal None.
  • Portal: WLAN › Guest Portal None. No WLAN policies on this SSID.
  • Check: switch port insights show 912 in the trunk list.
  • Trap: Guest Portal set to anything but None.

Netgear

  • VLAN: switch: VLAN › 802.1Q › Advanced › add 912.
  • Ports: VLAN Membership › 912: box and AP ports T. PVID stays 1.
  • SSID: Insight › Wireless › SSID. Security Open, VLAN 912, Captive Portal off.
  • Portal: Insight SSID › Captive Portal off.
  • Check: the port shows both 1 (U) and 912 (T).
  • Trap: changing PVID to 912. That untags guest traffic and kills the SnapGuard's LAN address.

Zyxel Nebula

  • VLAN: nothing to create at site level.
  • Ports: Switches › Switch ports › box and AP ports. trunk, PVID 1, Allowed VLANs 1,912.
  • SSID: Access points › SSID settings. Security Open, VLAN 912, Captive portal disabled.
  • Portal: SSID › Captive portal disabled. Gateway: no VLAN interface for 912.
  • Check: the switch port summary shows 912 allowed.
  • Trap: creating a 912 interface on the Nebula gateway with DHCP on.

MikroTik

  • VLAN: Bridge › VLANs. No VLAN interface with an address for 912.
vlan-ids=912 tagged=bridge,etherA,etherB
  • Ports: box and AP ports as tagged members, with filtering on the bridge.
vlan-filtering=yes
  • SSID: CAPsMAN datapath, with Security profile none.
vlan-mode=use-tag vlan-id=912
  • Portal: nothing in this menu bound to the bridge or the 912 interface.
/ip hotspot
  • Check: this shows 912 tagged on the right ports.
/interface bridge vlan print
  • Trap: ip hotspot enabled on the same bridge.

Cisco and HP CLI

  • VLAN: create the VLAN. No interface vlan 912, no DHCP pool.
vlan 912
  • Ports: IOS, then ProCurve.
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan add 912

vlan 912 tagged [ports]
  • SSID: controller WLAN mapped to VLAN 912, Layer 2 security None, web auth off.
  • Portal: WLAN › Layer 3 security None, web auth off.
  • Check: this lists 912 as allowed and active.
show interfaces trunk
  • Trap: access mode on the box port. It can only carry one line.

Firewall in front

SonicWall, Sophos, WatchGuard or pfSense: nothing to do for VLAN 912. Make sure no guest services or captive portal of its own sits on the zone the SnapGuard plugs into.

Check it worked

Join the guest SSID on a phone. It should get an address from the SnapGuard's range in your setup email, and any http page should open the Stampede portal.

Email support at agent@stampede.ai with:

  • The venue name.
  • The controller make and model.
  • Screenshots of the guest network, SSID and switch port settings.

Good to know

  • The guest VLAN ID must match the one in the setup email.
  • Leave every other SSID and VLAN as it is. Only 912 turns toward the box.
  • To set up the box itself in Stampede, see set up a new SnapGuard box.
  • All this is done in the venue's own switches and controller, by whoever manages them.
Related searches

Related articles

All Guest Wi-Fi articles

Still stuck, or have account-specific questions?

  1. Log in to stampede.ai
  2. Press Command + /On Windows, press Ctrl + /.
  3. Ask the agentIt answers about your own venues and account.
Log in to stampede.ai