https://community.extremenetworks.com/t5/extremewireless-wing/i-would-that-the-guest-user-traffic-can-then-be-forwarded-over/m-p/22163#M1709 Yes this is possible, but not required, as it is easier to use mint to tunnel the traffic, As you are terminating the traffic on the 4K Example config below wlan TMELABS-GUEST ssid TMELABS-GUEST vlan 25 bridging-mode tunnel encryption-type none authentication-type none nx65xx DATACENTER-NX6500 bridge vlan 25 tunnel-over-level2 ip igmp snooping ip igmp snooping querier ip name-server 192.168.10.6 ip domain-name tmelabs.local ! ! Configuration Removed for Brevity ! interface up1 description UPLINK switchport mode trunk switchport trunk native vlan 20 switchport trunk native tagged switchport trunk allowed vlan 20,23,25 ! ! Configuration Removed for Brevity ! use management-policy CONTROLLERS use firewall-policy default use auto-provisioning-policy DATACENTER ntp server 192.168.10.6 no auto-learn-staging-config service pm sys-restart router ospf service fast-switching ! ! profile ap6532 STORES-AP6532 bridge vlan 25 tunnel-over-level2 ip igmp snooping ip igmp snooping querier ip name-server 192.168.10.6 ip domain-name tmelabs.local ! ! Configuration Removed for Brevity ! interface radio1 wlan TMELABS-DOT1X bss 1 primary wlan TMELABS-PSK bss 2 primary wlan TMELABS-GUEST bss 3 primary interface radio2 wlan TMELABS-DOT1X bss 1 primary interface ge1 description UPLINK switchport mode trunk switchport trunk native vlan 21 no switchport trunk native tagged switchport trunk allowed vlan 21-22 interface vlan21 ip address dhcp ip dhcp client request options all interface pppoe1 use management-policy ACCESS-POINTS use firewall-policy default ntp server 192.168.10.6 service pm sys-restart router ospf Please note when using level 2 mint links make sure each site is a separate RF domain ( this includes the controller) also make sure the control vlan is set to the native vlan of the remote aps ( this is set in each RF domain) Thu, 30 Aug 2018 20:14:00 GMT Andrew_Blomley 2018-08-30T20:14:00Z https://community.extremenetworks.com/t5/extremewireless-wing/i-would-that-the-guest-user-traffic-can-then-be-forwarded-over/m-p/22162#M1708 i would that the guest user traffic can then be forwarded over the L2TPV3 tunnel<BR /> <BR /> Thu, 30 Aug 2018 18:33:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/i-would-that-the-guest-user-traffic-can-then-be-forwarded-over/m-p/22162#M1708 yohan_vaisseau 2018-08-30T18:33:00Z https://community.extremenetworks.com/t5/extremewireless-wing/i-would-that-the-guest-user-traffic-can-then-be-forwarded-over/m-p/22163#M1709 Yes this is possible, but not required, as it is easier to use mint to tunnel the traffic, As you are terminating the traffic on the 4K Example config below wlan TMELABS-GUEST ssid TMELABS-GUEST vlan 25 bridging-mode tunnel encryption-type none authentication-type none nx65xx DATACENTER-NX6500 bridge vlan 25 tunnel-over-level2 ip igmp snooping ip igmp snooping querier ip name-server 192.168.10.6 ip domain-name tmelabs.local ! ! Configuration Removed for Brevity ! interface up1 description UPLINK switchport mode trunk switchport trunk native vlan 20 switchport trunk native tagged switchport trunk allowed vlan 20,23,25 ! ! Configuration Removed for Brevity ! use management-policy CONTROLLERS use firewall-policy default use auto-provisioning-policy DATACENTER ntp server 192.168.10.6 no auto-learn-staging-config service pm sys-restart router ospf service fast-switching ! ! profile ap6532 STORES-AP6532 bridge vlan 25 tunnel-over-level2 ip igmp snooping ip igmp snooping querier ip name-server 192.168.10.6 ip domain-name tmelabs.local ! ! Configuration Removed for Brevity ! interface radio1 wlan TMELABS-DOT1X bss 1 primary wlan TMELABS-PSK bss 2 primary wlan TMELABS-GUEST bss 3 primary interface radio2 wlan TMELABS-DOT1X bss 1 primary interface ge1 description UPLINK switchport mode trunk switchport trunk native vlan 21 no switchport trunk native tagged switchport trunk allowed vlan 21-22 interface vlan21 ip address dhcp ip dhcp client request options all interface pppoe1 use management-policy ACCESS-POINTS use firewall-policy default ntp server 192.168.10.6 service pm sys-restart router ospf Please note when using level 2 mint links make sure each site is a separate RF domain ( this includes the controller) also make sure the control vlan is set to the native vlan of the remote aps ( this is set in each RF domain) Thu, 30 Aug 2018 20:14:00 GMT https://community.extremenetworks.com/t5/extremewireless-wing/i-would-that-the-guest-user-traffic-can-then-be-forwarded-over/m-p/22163#M1709 Andrew_Blomley 2018-08-30T20:14:00Z