This SSID will normally have no encryption. It is configured to provides internet access to clients while keeping them isolated from the corporate network using NAT mode and firewall rules. A bandwidth limit is also used to prevent guest clients from hogging bandwidth. APs whose coverage cells extend into guest areas should have this SSID enabled. It also shouldn’t use legacy data rates and have band steering enabled.
This SSID should be for trusted users. The SSID will use encryption (WPA2-PSK or WPA2-Enterprise) and network access via bridge mode. Different VLANs, firewall rules, traffic shaping and bandwidth limits can be based on user or device class and can be assigned using Group Policy. APs whose coverage cells extend into internal areas should have this enabled. It also shouldn’t use legacy data rates and have band steering enabled.
If necessary, an SSID for legacy devices that use legacy encryption or data rates can be enabled. This SSID will normally use bridge mode with VLANs and should only be enabled in areas where legacy devices exist. While band steering should be enabled, and legacy bit-rates disabled, this SSID can be an exception if required to support the legacy clients.