Sonicwall - How to create virtual access points

Creating a Sonicwall virtual access point isn't difficult, but there are a few steps involved. In my case, I created a virtual access point for my internal users (with full access to the LAN), and a guest wireless network with no access to the LAN. This was done on a TZ-205W with no Sonicpoint device involved. I created the wireless LAN zone first. This is easily done by editing the wireless settings on the Sonicwall admin page. Create your SSID, security, etc. You will then go to the Firewall settings and view the WLAN to LAN rules using the "matrix" view. In my case I changed access so that the WLAN had "allow all" access to the LAN (it defaults to "deny all"). After completing these steps, you will have a wireless network with full access to your LAN.

To create the Guest wireless network, you need to do more work. The steps involved are:

• Go to Network -->> Zones and create a new zone for your guest wireless network. Call it whatever you want, and choose "wireless" as the security type. If you subscribe to other Sonicwall services you can check them off here. Check "allow interface trust" if you want the guest users to have access to each other (typically you would leave this unchecked).
• Go to Network -->> Interfaces and click "add interface". Make sure the type is "virtual interface". For zone, you will pick the zone you just created for the guest wireless network. For vlan tag, you can pick any number between 2 to 4094. For parent interface, you will pick W0. Enter a static IP address that is NOT part of your LAN subnet, enter an appropriate subnet mask, and enter a comment if you wish.
• Go to Wireless -->> Virtual Access Point and click "add". You will add the SSID and security settings for your guest wireless network here. Choose an SSID name, pick the interface you created earlier as the subnet name, and check the box labeled "enable virtual access point". If you want your SSID to not be broadcast, select "enable SSID suppress". Next go to the Advanced tab and set the security for your guest wireless network.
• Go to Wireless -->> Virtual Access Point and edit the default group called "Internal AP group". Add the virtual access point you just created to the Internal AP group.
• Go to Wireless -->> Settings. Scroll to the bottom section called "Wireless Virtual Access Point". Click the drop down box and select "Internal AP group". Your guest wireless network will not work until you do this. 
• Last but not least, go to the firewall settings and make sure that your new zone has "deny all" access to your LAN zone. It should be set that way by default, but it never hurts to check.

That should do it. You will now have two wireless networks...one for your LAN users and one for your guests. Enjoy!