Guest Wi-Fi Does What I think?

[Dafish2]

Reading suggest it does, but I'd like to get this right so I'm going to ask a few pretty elementary questions.

Background:
I'm running an RT-AC-86U as primary demarc from my ISP in "Wireless Router Mode/Aimesh router Mode" running 3.0.0.4..386 (latest available) and a downstream AX-68U connected via 1000BT and running as the "Access Point Mode / Aimesh router in AP mode" on 3.0.0.4.388 (latest available). Both routers had firmware updates available, yet both are set to "auto-update". Both were updated before proceeding.

Objective:
I'm uncomfortable with the amount of IoT things I have in general, and China in particular, to say nothing of the misc threats out there. My thought was to implement Guest Wi-Fi services, both 2.4 and 5.0, assign the "old" SSID's to it, then bring up new SSID's on the normal Wi-Fi and migrate the few personal data devices (computers, tablets, phone, etc) to same. Thus leaving the scads of wi-fi devices alone and making the "production" Wi-Fi and LAN be the "Secure" traffic. This has been done with reasonable ease and success. However.. (isn't there always):

Guest Questions:
1) Am I running Aimesh or am I running AP Mode? I don't find the language in the operating modes clear...
2) It was my thought the guest network would forward out to the internet and back (if allowed, and I did), allow communication among other guest devices, but not be able to communicate to the LAN or primary Wi-Fi's. Is that correct? (Yes, I get they are sharing bandwidth).
2) On the "Guest" network I set "Guest network on Aimesh" to "All Mesh Nodes" as I wanted guest devices on both routers to be to communicate. I then set up matching SSID's on both routers (opposite ends of the house, different channels). Which I've been doing on the production Wi-Fi's for decades, so... Did I handle the "Guest network on Aimesh" question correctly? Did this maintain separation of "guest" and "secure" traffic? Or did I just blend the LAN and guest traffic together? Hell, am I really even running Aimesh?
3) Re the guest network, am I correct in thinking the routers are simply using a VLan for the guest wifi and passing vlan tags over the mesh to each other?

Problem and Questions:
For some reason, and I believe it's new and a result of one of two things, I'm seeing issues:
* Both router/AP's are dropping packets now and again, quite a bit more on restart (power cycled the whole house) and for several minutes. In time, lets say 5 minutes, the primary stopped dropping traffic while the downstream mesh unit will only occasionally drop pings (from LAN attached PC). Statistically insignificant, but it was historically rock solid. Thoughts? Does the guest burden the router enought that mass wi-fi registration makes them struggle on home power cycle (lots of devices registering)?
* Neither router is passing 60% CPU util, but both cores are very spikey now. They used to be pretty quiet, linear, and low util. Single digit. RAM for both is 70-75%, and this seems normal for them. Guest network again pushing them, or?
* I note Aimesh ethernet backhaul was set to "off". That's unusual, and I've reset it back to enabled (yep, the're connected by 1000BT). Bug (feature)? of an update along the way? (And Cpu util seems to have both dropped and stabilized.)
* Aimesh/topology/client list/wired - This shows a metric crap ton (a technical term) or wireless devices. Sup w/that?

Thanks for insights guys!

-d

 

[bbunge]

The guest WIFI, guest #1 on 2.4 GHz and 5 GHz for your firmware, does use VLAN between the router and Aimesh node. And yes, they will share the 1 GB Ethernet backhaul bandwidth. With that said, do not use a managed switch between the router and node.

The SSID of the AiMesh node is set from the router. If you are able to set the "node" SSID and WIFI channels your "node" is set as an access point and not using AiMesh. And the guest WIFI will not extend to the "node" or AP.

Leave the Ethernet Backhaul to Off as there could be issues if the Ethernet looses connection. I have tested both ways and have better connections with all the AiMesh settings to auto. The router and node will figure things out.

Make sure the Ethernet backhaul goes from a router LAN port to the AiMesh node WAN port.

If you are dropping packets there could be several factors involved. All the clients trying to connect after a reboot may be one. Long SSID and passphrase could be another. Use simple SSID and a passphrase of 8 to 10 letters and numbers (no special characters). Avoid power cycle or router/node reboot. If you do reboot give the AiMesh network time to settle in before making changes.

 

[Dafish2]

Thank you!

FWIW, I've been using a few terms poorly, mostly because I find the menu language confusing. I've corrected above (note italic) and will try to be more clear below:

* I suspect I'm not really using Aimesh at all, as the reference to it in the Admin/operation mode screen is misleading me. At root I'm running a primary router with a downstream AP connected via 1000BT, and both are connected via LAN ports. I fixed this description in the opening post.

* I do not have the downstream router connected via WAN port, as Asus says to connect via lan ports. Is that a mistake?

Does "AP mode" carry the guess vlan tags across & between the two routers? Meaning is the traffic remaining segregated?

I am able to ping "guest wifi" devices on either router from a LAN attached PC connected to the "main" router, so I'm certainly not getting what I'd expected.

 

[bennor]

* I suspect I'm not really using Aimesh at all, as the reference to it in the Admin/operation mode screen is misleading me. At root I'm running a primary router with a downstream AP connected via 1000BT, and both are connected via LAN ports. I fixed this description in the opening post.

You can check if your main router, the RT-AC86U, has any AiMesh Nodes connected to it by accessing the AiMesh menu option. Any connected AiMesh Node will be listed UNDER the main router. Example - ZenWiFi AX is main router and a second ZenWiFi AX is the AiMesh Node:

If you do not know how to setup a secondary Asus router in AP (Access Point) mode, see the following Asus Support document:
[Wireless Router] How to set up access point (AP) mode?

If you access the second router, the RT-AX68U, it's main home screen should indicate it's in AP mode if it was configured as AP mode and not AiMesh Node. Example:

 

[bbunge]

Thank you!

FWIW, I've been using a few terms poorly, mostly because I find the menu language confusing. I've corrected above (note italic) and will try to be more clear below:

* I suspect I'm not really using Aimesh at all, as the reference to it in the Admin/operation mode screen is misleading me. At root I'm running a primary router with a downstream AP connected via 1000BT, and both are connected via LAN ports. I fixed this description in the opening post.

* I do not have the downstream router connected via WAN port, as Asus says to connect via lan ports. Is that a mistake?

Does "AP mode" carry the guess vlan tags across & between the two routers? Meaning is the traffic remaining segregated?

I am able to ping "guest wifi" devices on either router from a LAN attached PC connected to the "main" router, so I'm certainly not getting what I'd expected.

With your AC68U in AP mode and a guest network set. up the connections will not be separated from the LAN network. And there will not be a VLAN between the AC86U and the AC68U.

Your best bet is to factory reset the AC68U and with the Ethernet cable connected to the WAN port of the AC68U set up an AiMesh from the GUI of the AC86U. With an AiMesh configured the settings of the AC68U will be governed by the settings of the AC86U.

AiMesh does work and in your case should be better than router/AP configuration to achieve you network goals.

 

[Dafish2]

Thanks gentlemen. Sadly things are worse, but that's another post..