How do I check that guest Wi-Fi cannot reach our internal network?

Join the guest network with a phone or laptop and try to reach internal systems: open the address of a file server, a printer's web page, the router's admin page and the office's internal name server. On your own network, a simple connection test or ping to internal address ranges shows whether anything answers. Then check the configuration: client isolation switched on, the guest network in its own VLAN or router port, internet access only, and the Wi-Fi system's admin interface not reachable from it. Repeat after every change to the Wi-Fi system, because firmware updates and new access points can reset settings. If the guest segment is monitored, NetSenX shows guest devices on the network map and flags any sessions from them to internal hosts, as well as scanning or lateral movement, on every plan. A guest device that reaches an internal server shows up as a connection that should not exist.

← All 45 questions on Zero trust, identity and segmentationAll topics