Can't extend Guest Network in roaming mode

Even though you can configure it, the none of the AirPort devices will create a guest network if it is configured in bridge mode. I can't find a definitive source for this just now, but if you do a search you'll see it mentioned multiple times.

Firmware version 7.6.3 added the feature to allow the guest network to be extended from another Apple router using either a wireless or Ethernet connection.....when the setup "wizard" in AirPort Utility 6.3.x is used to set things up.

So, the minimum requirements would be......

1) All AirPorts must be running firmware 7.6.3 or higher

2) The setup "wizard" in AirPort Utility 6.3.x must be used to set up the "extending" AirPort from a factory default condition. (You cannot start poking around in AirPort Utility and try to configure the "extending" AirPort manually. That won't work).

I just tested this again and it works fine when extending another AirPort using either wireless or Ethernet. Both the "main" and "guest" networks are extended just fine. I used an AirPort Extreme running 7.7.3 and an AirPort Express running 7.6.4 to test.

Even though you can configure it, the none of the AirPort devices will create a guest network if it is configured in bridge mode

They will work just fine, if the requirements above are met.

You might be thinking of connecting the AirPort to a third party router here using Ethernet.

In that case, the AirPort would be in Bridge Mode.....and if you try to enable the Guest Network on the AirPort.....that will not work.

Users try this all the time and complain that they have "enabled" the Guest Network, but devices cannot connect to the network, or if they can connect to the Guest Network, the devices cannot get an Internet connection.

Used to be that the setting to enable the Guest Network did not even appear in AirPort Utility if an AirPort was in Bridge Mode. It confuses a lot of users now, unfortunately.

I just tested this again and it works fine when extending another AirPort using either wireless or Ethernet. Both the "main" and "guest" networks are extended just fine. I used an AirPort Extreme running 7.7.3 and an AirPort Express running 7.6.4 to test.

Here is my question then: In the Ethernet connection case, how are the "guest" packets from the bridged AirPort prevented from co-mingling with those from the "normal" network - and how does the "router" AirPort tell the difference? It could work if some sort of AirPort to AirPort tunnel were configured. I get how it works when all wireless (completely difference SSIDs isolate the traffic).

Mind running a test for me? For two devices on the same guest network (not roamed or extended), can one see the other (i.e., can one ping the other)?

Here is my question then: In the Ethernet connection case, how are the "guest" packets from the bridged AirPort prevented from co-mingling with those from the "normal" network - and how does the "router" AirPort tell the difference?

Different vlan.

Guest network is set on the main router airport it opens a secondary vlan. This secondary vlan must be available for the bridged device to connect packets marked on the secondary vlan.

People have figured out how to get around the issue by using a managed switch where you can set vlans.

The airports however are far from robust and as various posts point out.. some people get things to work when they shouldn't.. eg connection from guest to the main lan can actually work.. these are definitely home routers.. and because Apple removes all the technical stuff.. it is impossible to tell what is going on. Even the stuff about needing to use the right airport utility has a wrongness to it!!

Different vlan.

Guest network is set on the main router airport it opens a secondary vlan. This secondary vlan must be available for the bridged device to connect packets marked on the secondary vlan.

Ah, yes. I was thinking about that after I posted. So the "non-guest" traffic would be on the default VLAN just in case there is anything between the two airports and the guest traffic would have a tag on it (I assume they use .Q). I may have to set this up and take a snif of the packets to satisfy my curiosity.

I answered my own question about the ping above - my MacBook connected to a guest network on my "spare" Express could not see an iPhone on the non-guest network - same Express.

I didn't totally complete that last thought... I could ping the iPhone when both the MacBook and phone were on the guest network, and not when only one was. As expected.

For two devices on the same guest network (not roamed or extended), can one see the other (i.e., can one ping the other)?

Sure, since all "guest" devices will be on the same 172.16.42.x subnet......Apple's default for the "guest" network.

Let's say that you put a wireless printer on the guest subnet....so "guests" can print things if they want. No problem....any of the guests can print to the printer....on the "guest" network.

Or, stated another way, if the "guests" could not "see" other devices on the same subnet, then they would not be able to reach the wireless printer.

Keep in mind that "guests" can only connect to the "guest" network using wireless. They cannot connect using Ethernet.

Maybe the notes on Apple's 7.6.3 will explain a bit more. See link below:

AirPort Base Station and Time Capsule Firmware Update 7.6.3

Sorry, I do not know what the problem might be. As I mentioned earlier things work fine for me when I try this.

As a test......here is what I would suggest. Leave the AirPort Time Capsule powered on, but power off all other AirPort Extremes for now.

On the main AirPort Time Capsule, remove the check mark in the box next to 5 GHz Network Name and Update to save those settings. This will result in both the 2.4 GHz and 5 GHz bands using the same wireless network name. Check to make sure that devices can connect to both the "main" and "guest" networks.

Power up one AirPort Extreme for a few minutes, then hold in the reset button for 7-8 seconds and release. Allow a full minute for the AirPort Extreme to restart to a slow, blinking amber light status.

Connect an Ethernet cable from one of the LAN <--> ports on the Time Capsule to the WAN "O" port on the AirPort Extreme. Use a direct Ethernet cable connection for this test.....no switches, etc......just a direct connection between the Time Capsule LAN port and AirPort Extreme WAN port.

Run the setup wizard on the AirPort Extreme. The first screen that appears should appear similar to this, except that you will see pictures of your devices:

Enter in a device name for the AirPort Extreme......example ExtremeOne, and click Next. The next screen that appears should look like this. Note that the message has changed to indicate that the AirPort Extreme is being configured to extend using Ethernet. This is important.

When you see the message of Setup Complete, click Done.

Test to see if the main and guest networks have been extended on the AirPort Extreme and report on your results.

For the "test", I am trying to make things as simple as possible to start....using as many of the default Apple settings as possible.

If we can get things working for the "test", then we will start adding features like the 5 GHz name one at a time and continue testing to see if any of the results change.

But, I think you will agree that it makes no sense to try advanced options first, before we can get things working in a simple way.

Important......before you setup the AirPort Extreme, please check a setting on the AirPort Time Capsule.

Open AirPort Utility, click on the Time Capsule, then click Edit in the smaller window

Click the Network tab at the top of the next window

Make sure that the setting for Router Mode = DHCP and NAT. It should already be set this way.

Then, check to make sure that the setting for DHCP Range is set to 10.9.1.2 to 10.0.1.200