The decision diagram and conclusion below, applies to any pair of OSS or vendor routers in the "guest" and "secure" roles.
Guest Router First, Secure Router Second
Option #1 is the recommended and accepted best practice. The guest network connects directly to the internet, and the secure router plugs into the guest Router.
> we have Zyxel gear were we can tag WLAN connections with a VLAN based on the SSID
Open-source SPR can place each wireless client device in its own VLAN, with a unique WPA3 passphrase for every client.
This allows granular, per-device rules for routing and filtering, instead of dumping all devices into one-VLAN-per-SSID.
The decision diagram and conclusion below, applies to any pair of OSS or vendor routers in the "guest" and "secure" roles.
> we have Zyxel gear were we can tag WLAN connections with a VLAN based on the SSIDOpen-source SPR can place each wireless client device in its own VLAN, with a unique WPA3 passphrase for every client.
This allows granular, per-device rules for routing and filtering, instead of dumping all devices into one-VLAN-per-SSID.